jQuery.html() does not correctly parse input values with "/>"

[accounts@…]

Examine the following code:

$(document.body).html('<select><option value="!/>">Test</option></select>');

The markup inserted into the DOM is this:

<select><option value="!></option>">Test</option></select>

See jsfiddle here:

​http://jsfiddle.net/wEp5p/

There is no requirement in jQuery.html() documentation that says the string passed in MUST BE HTML-encoded.

However, in this example, jQuery.html() does not act correctly UNLESS it IS HTML-encoded.

[dmethvin]

There are many things we don't state in the documentation because they seem rather obvious. ​http://www.w3.org/International/questions/qa-escapes#use

[gibson042]

​HTML5 throws in a monkey wrench, but in my opinion it's pointless to fix this without a more sophisticated regular expression, and I remain convinced that ​such an improvement does not offer enough value to justify its large size.

At most, I could see exposing pre-innerHTML replacement arguments as properties of jQuery for users to tweak if they want to accommodate such edge cases.