It can be used for obfuscation, making it a little bit harder to decode a CSS, HTML and JavaScript. Also this can be a good compression method. (Assuming you parse CSS and JavaScript)
$('.' + div.attr('id')).each(function() {
$('body').append($(this); // Moving elements
});
Now imagine that I give the id attribute the following id: 'nada,<script src="evil.js"></script>'I suppose this is a bit contrived but still fun.
FYI, the `.append` line is missing a closing `)`. Also, you probably don’t want to use `$(this)` in that case, you could just use `this`.
As for the escaping, how would we do that? jQuery specifically allows something like $('<div/>'). As far as I know, it does not have an escape character to prevent that. My point is that that character would need to be added to jQuery and other libraries that have the same function for fetching DOM elements and creating them. Obviously, in raw JavaScript this is not a problem since there it's two different methods (document.getElementById and document.createElement).
var str = "Hello \"world\", how\\are you";
But once you have your string composed, jQuery does not as far as I know have a way to escape characters like < and >.