sstephenson/eco — pull request #67 by cantino (2014-10-24 18:47:17+00:00)
Title: Security issue

Eco's default `__escape` implementation doesn't escape single quotes, which makes XSS attacks like the following possible:

```html

```

with a @value of `x'onmouseover='alert(document.domain)`, an XSS occurs.

This fork fixes the issue by using Underscore's escape.