Agreed! I can't even count how many times I made that mistake.
On Feb 14, 2013 12:44 AM, "Sindre Sorhus" <notifications@github.com> wrote:

> In labs/architecture-examples/maria/src/js/util.js:
>
> > @@ -6,7 +6,11 @@ checkit.isBlank = function(str) {
> >  };
> >
> >  checkit.escapeHTML = function(str) {
> > -	return str.replace('&', '&amp;').replace('<', '&lt;');
> > +	return String(str)
> > +		.replace(/&(?!\w+;)/g, '&amp;')
> > +		.replace(/</g, '&lt;')
> > +		.replace(/>/g, '&gt;')
> > +		.replace(/"/g, '&quot;');
>
> Hah, thanks for the link. I had no idea. Even more reason why the browser
> should have a escapeHTML method.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/addyosmani/todomvc/pull/440/files#r3005995>.
>
>