Fix unsafe use of jQuery .html()

[l2dy]

.html() can introudce cross-site-scripting (XSS) vulnerabilities with strings from untrusted sources. Use .text() instead or sanitize the input.

[l2dy]

@joyqi Anything else I need to do to get this merged?

[joyqi]

Hi @l2dy , I'm always considering adding XSS protection to editor preview, but I'm not sure if it's necessary.
If someone has the access to the admin panel, he can do anything, including adding XSS code to the database.

[l2dy]

An attacker does not have to gain access to the admin panel to exploit this. It's a stored XSS attack that works if an admin tries to edit a malicious comment, allowing the attacker to inject arbitrary code into the admin panel.

[joyqi]

You're right, at least we need XSS protection for comments.