Hah, thanks for the link. I had no idea. Even more reason why the browser should have a `escapeHTML` method.