Funny, my HTML based HN app on iOS actually rendered[0] an input field in the title. Disappeared after a second. No one submit titles with <script>alert()</script> please!
It looks like the title in the API is encoded correctly[1].
[0] http://i.imgur.com/CDnwDZJ.jpg
[1] https://hacker-news.firebaseio.com/v0/item/10433793.json?pri...