title: jquery - how to escape html to prevent XSS?
body: <p>I'm using laravel, when a user sends a text message, it may contain some malicious code. When I use <code>{{}}</code> it will show me the exact text the user has sent. If he has sent</p>
  
  <pre><code>&lt;script&gt;alert("malicious")&lt;/script&gt;
  </code></pre>
  
  <p>it will show exactly the same and it's good, but when I use jquery ajax, I put the fetched data to some variables within some html tags and lastly append all of them to a main tag like so:</p>
  
  <pre><code>   data = '';
      //loop starts here // some otger codes deleted for cleanness
      data += "&lt;h2&gt;"+response.name+"&lt;/h2&gt;";
      data += "&lt;p&gt;"+response.description+"&lt;/p&gt;";
      $('#mydata').html(data);
  </code></pre>
  
  <p>and now the problem is that if I use <code>html()</code> the user malicious code will be executed and if I don't, the result will not be shown as html.</p>
  
  <p>I guess I should do something with <code>$.parseHTML</code>, isn't it?</p>
  
  <p>Thanks</p>