nl_tokens: Escapes HTML string ( to mitigate possible DOM XSS attacks ) .
pl_tokens: function escapeHTML ( s ) { if ( ! initialConfig . escapeHTML ) return String ( s ) . <mask> ( '\n' ) . join ( '<br>' ) ; return String ( s ) . split ( / & / g ) . join ( '&amp;' ) . split ( '"' ) . join ( '&quot;' ) . split ( "'" ) . join ( '&#39;' ) . split ( '<' ) . join ( '&lt;' ) . split ( '>' ) . join ( '&gt;' ) . split ( '/' ) . join ( '&#x2f;' ) . split ( '\n' ) . join ( '<br>' ) ; // Allow line breaks }