ajaxorg/apf — pull request #74 by mikedeboer (2012-09-13 15:35:53+00:00)
Title: bluntly added escapeHTML() to LM _val and _mval methods

@javruben and @giannis

This seems to fix the XSS vulnerabilities of adding arbitrary HTML like `` into XML that will be rendered in LM statements like `[@name]` and the like and does NOT seem to break any other existing functionality like E4X-style syntax in LM and adding AML elements from within LM.

See the test file `test/livemarkup.html` and execute the following statement from the browser console:
```javascript
apf.xmldb.setAttribute(mdlBlah.data.getElementsByTagName("person")[0], "name", "")
```