   resize: ->
     return  unless @_clone
     @_clone.appendTo 'body' unless document.body.contains @_clone[0]
-    @_clone.html @getValue().replace /\n/gm, "<br />"
+    @_clone.html Encoder.XSSEncode @getValue()
+    @_clone.append document.createElement "br"
+
     height = @_clone.height()
-    if @$().css('box-sizing') is "border-box"
-      padding    = parseInt(@_clone.css("padding-top"), 10) + parseInt(@_clone.css("padding-bottom"), 10)
-      border     = parseInt(@_clone.css("border-top-width"), 10) + parseInt(@_clone.css("border-bottom-width"), 10)
-      height     = height + border + padding
-
-    @setHeight height
+    if @$().css("boxSizing") is "border-box"
+      padding = parseInt(@_clone.css("paddingTop"),     10) + parseInt(@_clone.css("paddingBottom"),     10)
+      border  = parseInt(@_clone.css("borderTopWidth"), 10) + parseInt(@_clone.css("borderBottomWidth"), 10)
+      height  = height + border + padding
+
+    @setHeight Math.max @initialHeight, height
 
   enableTabKey:-> @inputTabKeyEnabled = yes
 

        @_clone.appendTo 'body'
        @_clone.css
          height        : "auto"
          "z-index"     : 100000
          width         : $input.width()
          padding       : $input.css('padding')
          "word-break"  : $input.css('word-break')
          "font-size"   : $input.css('font-size')
          "line-height" : $input.css('line-height')

    @on "blur", =>
      @_clone.detach()

      event.preventDefault()
      t.selectionStart = t.selectionEnd = ss + tabLength

  viewAppended: ->
    @initialHeight = @$().height()
