Still vulnerable. This should be something like:

```javascript
$res.html('');
contents.split(/[\r\n]+/).map(function(l) { var $p = $('<p>'); $p.text(l); $res.append($p); });
```