Remove / from the list of escaped chars and add `.

It's probably fine not to escape /, since its only danger is in ending
entities (like &amp/). This isn't a problem for us, since the badChars
regex won't allow it and the & will get escaped.

It turns out ` can be used to quote attribute values in IE, so it needs
to be escaped along with " and '.

lib/handlebars/utils.js

@@ -19,11 +19,11 @@ Handlebars.SafeString.prototype.toString = function() {
     ">": ">",
     '"': """,
     "'": "'",
-    "/": "/"
+    "`": "`"
   };
 
-  var badChars = /&(?!\w+;)|[<>"'\/]/g;
-  var possible = /[&<>"'\/]/;
+  var badChars = /&(?!\w+;)|[<>"'`]/g;
+  var possible = /[&<>"'`]/;
 
   var escapeChar = function(chr) {
     return escape[chr] || "&amp;"

spec/qunit_spec.js

@@ -90,7 +90,7 @@ test("escaping expressions", function() {
  shouldCompileTo("{{&awesome}}", {awesome: "&\"\\<>"}, '&\"\\<>',
         "expressions with {{& handlebars aren't escaped");
 
- shouldCompileTo("{{awesome}}", {awesome: "&\"'/\\<>"}, '&amp;&quot;&#x27;&#x2F;\\&lt;&gt;',
+ shouldCompileTo("{{awesome}}", {awesome: "&\"'`\\<>"}, '&amp;&quot;&#x27;&#x60;\\&lt;&gt;',
         "by default expressions should be escaped");
 
 });
@@ -397,7 +397,7 @@ test("basic partials", function() {
   var string = "Dudes: {{#dudes}}{{> dude}}{{/dudes}}";
   var partial = "{{name}} ({{url}}) ";
   var hash = {dudes: [{name: "Yehuda", url: "http://yehuda"}, {name: "Alan", url: "http://alan"}]};
-  shouldCompileTo(string, [hash, {}, {dude: partial}], "Dudes: Yehuda (http:&#x2F;&#x2F;yehuda) Alan (http:&#x2F;&#x2F;alan) ",
+  shouldCompileTo(string, [hash, {}, {dude: partial}], "Dudes: Yehuda (http://yehuda) Alan (http://alan) ",
                   "Basic partials output based on current context.");
 });
 
@@ -405,7 +405,7 @@ test("partials with context", function() {
   var string = "Dudes: {{>dude dudes}}";
   var partial = "{{#this}}{{name}} ({{url}}) {{/this}}";
   var hash = {dudes: [{name: "Yehuda", url: "http://yehuda"}, {name: "Alan", url: "http://alan"}]};
-  shouldCompileTo(string, [hash, {}, {dude: partial}], "Dudes: Yehuda (http:&#x2F;&#x2F;yehuda) Alan (http:&#x2F;&#x2F;alan) ",
+  shouldCompileTo(string, [hash, {}, {dude: partial}], "Dudes: Yehuda (http://yehuda) Alan (http://alan) ",
                   "Partials can be passed a context");
 });
 
@@ -414,7 +414,7 @@ test("partial in a partial", function() {
   var dude = "{{name}} {{> url}} ";
   var url = "<a href='{{url}}'>{{url}}</a>";
   var hash = {dudes: [{name: "Yehuda", url: "http://yehuda"}, {name: "Alan", url: "http://alan"}]};
-  shouldCompileTo(string, [hash, {}, {dude: dude, url: url}], "Dudes: Yehuda <a href='http:&#x2F;&#x2F;yehuda'>http:&#x2F;&#x2F;yehuda</a> Alan <a href='http:&#x2F;&#x2F;alan'>http:&#x2F;&#x2F;alan</a> ", "Partials are rendered inside of other partials");
+  shouldCompileTo(string, [hash, {}, {dude: dude, url: url}], "Dudes: Yehuda <a href='http://yehuda'>http://yehuda</a> Alan <a href='http://alan'>http://alan</a> ", "Partials are rendered inside of other partials");
 });
 
 test("rendering undefined partial throws an exception", function() {