rstudio/shiny — pull request #627 by yihui (2014-10-20 06:20:38+00:00)
Title: escape HTML entities to avoid XSS attacks in DataTables

BTW, per recommendation of http://datatables.net/manual/server-side, the parameter `draw` is coerced to integer