2f4644529c
It's probably fine not to escape /, since its only danger is in ending entities (like &/). This isn't a problem for us, since the badChars regex won't allow it and the & will get escaped. It turns out ` can be used to quote attribute values in IE, so it needs to be escaped along with " and '.