No, I meant that in the sense of altering element _content_ instead of _attributes_ (which is certainly **not** desired). The difference is substantial: imagine the effects of this PR on `$el.html( "Example vulnerability: <pre><img onerror='alert(\"Pwned!\")'/></pre>" )`.

> So maybe a different valid prefix would be a middle ground we could agree on?

There's no prefix that can both produce valid output and avoid attribute collision in all cases, but the value of `jQuery.expando` is close enough that we could safely pretend. However, even disregarding the above issue (which I'm not prepared to do), there's still either a) the unrequested alteration of input, or b) the performance hit of revisiting newly-created elements to undo it, neither of which I like.

Personally, I prefer encouraging everyone to sanitize user input before passing it to jQuery as HTML (or better yet—not doing so) over paying the size/performance/complexity/maintenance costs of trying to solve every edge case ourselves.