blobaugh/misspelling-reporter — pull request #32 by itsananderson (2013-05-31 02:03:29+00:00)
Title: Eliminate JS evaluation of unsafe text

If the selection is blindly injected into the click event, malicious text (from comments for example) could be executed.

Example exploit (including quotes): '+alert('hacked')+'