crucialfelix/django-ajax-selects — comment on commit 6b64d9c953d0b30713f8cdb45494554f22b627d7
File: example/lookups.py line 43
By sjrd:

`obj.name` and `obj.url` be `escape()`'ed

```Python
return u"%s

%s

" % (escape(obj.name),escape(obj.url))
```