-
_.clone(options) passed in to a function - Is a simple clone correct / enough? Because nested objects and arrays will be copied by reference (underscore clone: Create a shallow-copied clone of the provided plain object. Any nested objects or arrays will be copied by reference, not duplicated.).
-
Escape all user entered content before rendering to template
-
If you need to pass a html entity into a template (like
 
) use the unicode equivalent (\u2009
) to avoid having to unescape it (and open up a potential vulnarability) -
double escaping
model.escape('name'); //template will *also* escape