title: Javascript sanitization: The most safe way to insert possible XSS html string
body: <p>Currently i'm using this method with jQuery solution, to clean string from possible XSS attacks.</p>
  
  <pre><code>sanitize:function(str) {
      // return htmlentities(str,'ENT_QUOTES');
      return $('&lt;div&gt;&lt;/div&gt;').text(str).html().replace(/"/gi,'&amp;quot;').replace(/'/gi,'&amp;apos;');   
  }
  </code></pre>
  
  <p>But i have a feeling it's not safe enough. Do i miss something?</p>
  
  <p>I have tried htmlentities from phpjs project here:
  <a href="http://phpjs.org/functions/htmlentities:425/">http://phpjs.org/functions/htmlentities:425/</a></p>
  
  <p>But it's kinda bugged and returns some additional special symbols. Maybe it's an old version?</p>
  
  <p>For example:</p>
  
  <pre><code>htmlentities('test"','ENT_QUOTES');
  </code></pre>
  
  <p>Produces:</p>
  
  <pre><code>test&amp;amp;quot;
  </code></pre>
  
  <p>But should be:</p>
  
  <pre><code>test&amp;quot;
  </code></pre>
  
  <p>How are you handling this via javascript?</p>