PERF: stop using jQuery to sanitize strings
correct spec