The only user-supplied value is the `field.value`, so I've escaped only it -- do you agree that's sufficient?

Before doing so I confirmed in the browser that it was indeed exploitable, so nice catch!