title: Backbone.js and XSS/HTML escaping
body: <p>I'm building a Backbone.js application and am wondering what's the best way to deal with XSS respectively HTML escaping when using Backbone.js.</p>
  
  <p>In the basic <a href="http://backbonejs.org/examples/todos/index.html">Todos example application</a> from the official Backbone.js documentation, the data is not escaped. Since this data is used in the template to render the todo entries, <strong>it is possible to execute Javascript code</strong> by entering the following text (can be reproduced at the link above):</p>
  
  <pre><code>"&gt;&lt;script&gt;alert('xss');&lt;/script&gt;
  </code></pre>
  
  <p>When using a REST server as storage backend, this XSS is persistent for every user.</p>
  
  <p>How do you solve this problem?</p>
  
  <p>My idea is to escape the data on the server, so the then returned data is safe to be used in a template. Do I then have to always use <code>wait: true</code>, to make sure no unescaped data is rendered? And for editing, add another attribute with the unescaped data, that can then be used to fill the textfield using <code>.val()</code>?</p>
  
  <p>Or do you do none of this and escape the data on the client, before rendering the template?</p>