Isn't there xss in the first demo? What if title is user supplied and it's something like <script>alert("xss")</script>