You can use the options to set the output as text() rather than html(), e.g. $('div').magicpreview('mp_', { 'change': 'text' });
But yes, I should really add a flag to strip out any script elements :)
But yes, I should really add a flag to strip out any script elements :)
<table style="background-image:url(javascript:alert(1))"><tr><td>Hi</td></tr></table>