CodeSeven/toastr — pull request #211 by mentholi (2014-11-19 07:34:29+00:00)
Title: Added support for escaping message and title. 

Added support for automatically escaping toastr title and message to prevent XSS vulnerabilities when showing toast's. To not break backwards compatibility escaping is optional and disabled by default.

To enable escaping you can either set global option or toggle escaping on or off when showing toastr.

Set escaping on by default:
```javascript
toastr.options.escapeHtml = true;
toastr.success('Hello!');
```

Enable escaping for single toast:
```javascript
toastr.success('Hello!', null, { escapeHtml: true });
```

This issue is has been raised before but was marked as wontfix because it would be breaking change. In this pull https://github.com/CodeSeven/toastr/pull/164 it was suggested that this is optional.

Related issues/pull requests:
https://github.com/CodeSeven/toastr/pull/83
https://github.com/CodeSeven/toastr/pull/164
https://github.com/CodeSeven/toastr/issues/152