Just classic XSS.

However, since I am currently also writing an app that includes Tweets, can anybody recommend a good way to escape HTML in JavaScript? To my surprise I could not find a quick answer (using jQuery atm). A lot of forums recommend just replacing "<" and ">", but I feel I would have to do more research to be sure that is sufficient. For one thing this would fail within HTML attributes (for example URLs pointing to twitter users, with the name taken from the tweet). I am also not certain about character encodings.

I'd prefer to have a tried and tested library to do the escaping, even if in the end it is just a one-liner.