title: Is .text() safe or not to sanitize data? [JQuery]
body: <p>I've seen that this question has been asked elsewhere:</p>
  
  <p><a href="https://stackoverflow.com/questions/24816/escaping-html-strings-with-jquery">Escaping HTML strings with jQuery</a></p>
  
  <p>The answer marked as correct by @travis says that .text() is fine. However, some people mentionned in the commentaries (e. g. @nivcaner and @lior) that this solution is not good. Where do we stand? Can I safely use it?</p>
  
  <p>I'm working on a web application where an user can create a document in his browser where tables, headers and videos can be added via JQuery. When the user "saves" his document, its structure is translated into an array, where all elements of the array consist of "pure" text, with no tags (e.g. there is one array element for each table cell which contains the text of that cell, etc.). Then the array is converted into JSON format and is sent to the server and is processed / sanitized / saved in JSON format via PHP.</p>
  
  <p>After that, the document can be accessed by other users, and this of course introduces potential security holes. The idea is that they read the JSON data from the server and then recreate the document via javascript/JQuery on the client side.</p>
  
  <p>While I'm pretty confident that my PHP code does its job of properly sanitizing the JSON data, I'm afraid of some attack where a malicious user could trick other users into reading JSON data from an untrusted source. For this reason, I have the feeling that it's better to also validate any JSON data coming from the server before re-creating tables, etc. on the client side. Assuming that the variable <code>currentCellText</code> holds the (JSON read) text to be written in the table cell <code>#mytd</code>, can I safely use the code <code>$("#mytd").text(currentCellText)</code> to re-create the cell contents?</p>