there must be definitively some javascript escaping otherwise security issue can be easily created.