Eliminate JS evaluation of unsafe text

If the selection is blindly injected into the click event, malicious text (from comments for example) could be executed.

Example exploit (including quotes): '+alert('hacked')+'