title: jQuery don't parse escaped HTML in .html() method
body: <p>Take for example this HTML:</p>
  
  <pre><code>&lt;td onclick="$(this).html('Wanted HTML: &lt;br&gt;; Unwanted HTML: &amp;lt;script&amp;gt;alert(&amp;#39;xss&amp;#39;)&amp;lt;/script&amp;gt;')"&gt;
  Click to Show&lt;/td&gt;
  </code></pre>
  
  <p>As you can see, I have already escaped (using PHP) the unwanted HTML to entities. But when you click the box it executes the JavaScript.</p>
  
  <p>If I change <code>.html</code> to <code>.text</code>, it displays the line breaks literally as well.</p>
  
  <p>How can I have it show the the <code>&lt;br&gt;</code>s as line breaks, but the <code>&amp;lt;</code>s and <code>&amp;gt;</code>s as literally less than and greater than signs when you click the box?</p>