xssFilter

var xss = new xssFilter();
xss.options('escape', true);

var candy = xss.filter(testHTML);