tabatkins/railroad-diagrams — pull request #8 by SimonSapin (2012-11-17 21:04:34+00:00)
Title: Prevent basic HTML injection in .toString()

See https://github.com/tabatkins/railroad-diagrams/commit/52b8ed70c9540c741f589c76b56046111701a1ac#commitcomment-2170089

Is this enough, or should more characters be escaped? What about attributes?