rails/rails — pull request #12345 by tjschuck (2013-09-24 18:54:10+00:00)
Title: HTML-escape backtick for IE

IE supports using the backtick for delimiting attributes. This pull request adds it to the list of characters to be HTML-escaped.

See also:

- https://news.ycombinator.com/item?id=2525126
- https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet#Grave_accent_obfuscation
- http://html5sec.org/#59