ginader/HTML5-placeholder-polyfill — pull request #24 by Krinkle (2012-09-28 18:25:48+00:00)
Title: Fix mangled placeholder (raw html needs escaping)

When constructing html, variables must always be escaped.
Alternatively, don't construct html but set properties
directly so that escaping is not needed.

If text contained any special characters those were mangled as they
were interpreted as HTML instead of a string (.attr() returns the text,
not the HTML).

Also, depending on what this is run on, this can very well be a security vulnerability (e.g. a page created by a user-input system that sanitizes input but allows placeholders (which are safe on their own)), then this script interprets it as raw HTML.