“Избегайте HTML -инъекции” Ответ

Избегайте HTML -инъекции

//You can encode the "<" and ">" to their HTML equivelant
html = html.replace(/</g, "<").replace(/>/g, ">");