caphun/jquery.inlineedit — pull request #25 by flashmob (2014-01-31 13:16:09+00:00)
Title: Fix XSS 

Problem

jquery.html() will run any js code that is passed in to it.
For example,
on the demo http://www.yelotofu.com/labs/jquery/snippets/inlineEdit/demo_final.html
enter:
```

```

Solution
- Changed code to convert HTML to entities.
- When saving to the server, make sure that entity decoded code is sent to the server.

Note: the br2nl feature is a little tricky. Left it as it. Perhaps this could be improved by replacing the textarea with a div and contenteditable="true" ?