About escapeHTML in util.js

[albertosantini]

https://github.com/rstudio/shiny/blob/master/srcjs/utils.js#L1

After reading about replacing one char after another is not a best practice (due to the order dependency of replacing and xss risk), I would suggest something like

function escape(s) {
  var escaped = {
    '&': '&',
    '<': '&lt;',
    '>': '&gt;',
    "'": '&#39;',
    '"': '&quot;'
  };
  return s.replace(/[&<>'"]/g, function (m) {
    return escaped[m];
  });
}

Credits to https://gist.github.com/WebReflection/df05641bd04954f6d366.

If you think there is some point here, I may prepare a PR.

[wch]

Sure, that sounds like a good idea. According to this, that method is also faster than what we currently have.