Securing jQuery against unintended XSS
tech.blog.box.com