documentcloud/backbone — pull request #2079 by taka84u9 (2013-01-06 15:05:14+00:00)
Title: Add an escape option to Model#toJSON

This patch adds an escape option to `Model#toJSON`.

Example:

```javascript
var model = new Backbone.Model({amp: '&', gt: '<'});
model.toJSON(); //=> {amp: '&', gt: '<'}
model.toJSON({escape: true}); //=> {amp: '&', gt: '>'}
model.toJSON({escape: 'amp'}); //=> {amp: '&', gt: '<'}
model.toJSON({escape: ['gt']}); //=> {amp: '&', gt: '>'}
```

### Why I need this?

I often use`Model#toJSON` with `_.template`. Then I have to use `<%- %>` instead of `<%= %>` to escape attributes because of XSS security vulnerability, but I think there are two problems.

1. `<%- %>` and `<%= %>` are too similar.
2. It is hard to write tests of DOM string since designers change them frequently.