crucialfelix/django-ajax-selects — comment on commit 6b64d9c953d0b30713f8cdb45494554f22b627d7
File: example/lookups.py line 67
By sjrd:

`obj.title` and `obj.group.name` be `escape()`'ed

```Python
return "%s

by %s

" % (escape(obj.title),escape(obj.group.name))
```