title: Node.js/JavaScript - Avoid users entering scripts and html entities
body: <p>so bit hard to explain but I will try:
  Basically I have chat application running on Node.js
  Client side:</p>
  
  <pre><code>function sentMessage(){
      if($('#messageInput').val() != "")
      {
      socket.emit('message', $('#messageInput').val());
      addMessage($('#messageInput').val(), "Me", new Date().toISOString(),
       true);
      $('#messageInput').val('');
      }
  }
  </code></pre>
  
  <p>so this does two things:<br>
  It sends message to server saying there is new message and at same time it adds message to chatwindow (client side).</p>
  
  <p>Server side:</p>
  
  <pre><code>socket.on('message', function (message) {
      socket.broadcast.emit('message', {
          'message' : entities.encode(message),
          'pseudo' : socket['final_user']
      });
  db.query('INSERT INTO messages (user_id, message) VALUES (\
  "'+socket['final_user']+'", "'+db.escape(message)+'")');    
  });
  </code></pre>
  
  <p>So server detects new message, and broadcasts to all users saying there is new message, here it is along with persons name. It also inserts it into database.</p>
  
  <p>So my problem is: if user enters something like  or alert("hello");</p>
  
  <p>it <strong>WORKS</strong> fine for other users, it does not appear and appears as plain code without causing mess, but for the user who entered it - it prints images and alert box.</p>
  
  <p>Also whenever user logs in later, and old messages are loaded using this function:</p>
  
  <pre><code>function loadMessages(msg, pseudo, time){
      $("#chatEntries").append('&lt;div class="messagesOLD"&gt;' +
      "&lt;span class='msg_date'&gt;"+dateFormat(time)+"&lt;/span&gt;&lt;span class='msg_seperator'&gt; | &lt;/span&gt;&lt;span class='msg_name'&gt;"+ pseudo + '&lt;/span&gt; : ' + msg + '&lt;/div&gt;');
  }
  </code></pre>
  
  <p>It also prints alerts and images to user. 
  I know many could say just use entities.encode() as I did on server side, but it doesn't work on client side for some reason.</p>
  
  <p>Okay I managed to fix loading previous messages and loading scripts to users because they are being loaded from server side, so I was able to use entities.encode() so now scripts and all possible exploits show up as plain code and are not executed.</p>
  
  <p>However - user who types it still gets the scripts executed. </p>
  
  <pre><code>function addMessage(msg, pseudo){
      var post_date = new Date();
      var timesp = post_date;
      if(pseudo == "Me"){
      $("#chatEntries").append('&lt;div class="message msg_owner"&gt;' +
      "&lt;span class='msg_date'&gt;"+dateFormat(timesp)+"&lt;/span&gt;&lt;span class='msg_seperator'&gt; | &lt;/span&gt;&lt;span class='msg_name'&gt;"+ pseudo + '&lt;/span&gt; : ' + msg + '&lt;/div&gt;');
  
      }
      else{
      $("#chatEntries").append('&lt;div class="message"&gt;' +
      "&lt;span class='msg_date'&gt;"+dateFormat(timesp)+"&lt;/span&gt;&lt;span class='msg_seperator'&gt; | &lt;/span&gt;&lt;span class='msg_name'&gt;"+ pseudo + '&lt;/span&gt; : ' + msg + '&lt;/div&gt;');
      }
          $('#chatEntries').scrollTop(1E10);
      }
  </code></pre>