Preventing XSS from within HTML elements
stackoverflow.com