Prefer writing that as `this.$('.email-suggestion').text(suggestion.address + '@' + suggestion.domain);`

Using [`.text()`](http://api.jquery.com/text/) will XSS-escape.