Merge pull request #2 from zhsj/fix-xss

Escape HTML

Author: inacho

src/bootstrap-markdown-editor.js

@@ -369,7 +369,7 @@
             html += '</div>'; // .btn-toolbar
         html += '</div>'; // .md-toolbar
 
-        html += '<div class="md-editor">' + $.trim(content) + '</div>';
+        html += '<div class="md-editor">' + $('<div>').text($.trim(content)).html() + '</div>';
         html += '<div class="md-preview" style="display:none"></div>';
 
         return html;