Update todo.js

prevented point of entry for an XSS attack.