Escape HTML tags

lib/web/assets/app.js

@@ -174,6 +174,28 @@ window.App = (function (window, document) {
 
         return container;
     };
+    
+    
+    /**
+     * Escape HTML tags
+     * @param  {String} text - String to escape
+     * @return {String}        Escaped string
+     * @private
+     */
+    var _escape = function(text) {
+        var entityMap = {
+            "&": "&",
+            "<": "&lt;",
+            ">": "&gt;",
+            '"': '&quot;',
+            "'": '&#39;',
+            "/": '&#x2F;'
+        };
+        
+        return String(text).replace(/[&<>"'\/]/g, function (s) {
+            return entityMap[s];
+        });
+    };
 
     return {
         /**
@@ -242,7 +264,9 @@ window.App = (function (window, document) {
             var div = document.createElement('div');
             var p = document.createElement('p');
             p.className = 'inner-line';
-
+            
+            // Escape HTML tags
+            data = _escape(data);
             p.innerHTML = _highlightWord(data);
 
             div.className = 'line';