Close XSS Vector

[adrian-enspired]

fixes #102

Found another bad use of innerHTML in addition to those fixed in #100

Note, this changes how the match function works:

• match now always returns a boolean (as its docblock claims ; )
• the contents of the provided option are now modified in-place (no more returning HTML as a string)

It seems the match function is only being used in one place, so these changes should not cause any unexpected behavior.

[adrian-enspired]

I also noted the use of innerHTML when assigning placeholder values. I did not change this as I expect users may be passing HTML to the placeholder config option deliberately, and changes would break existing usage. This should probably be more closely reviewed, however.