crucialfelix/django-ajax-selects — comment on commit 6b64d9c953d0b30713f8cdb45494554f22b627d7
File: example/lookups.py line 25
By sjrd:

`obj.name` and `obj.email` be `escape()`'ed

```Python
return u"%s

%s

" % (escape(obj.name),escape(obj.email))
```