Html escape issue

[Sylwekqaz]

In demo html output is not escaped. for example if you type <img src="https://www.google.pl/images/nav_logo242.png" /> in textbox then demo shows Google logo instead of text

[MarkoMackic]

I don't think it's important for demo here but if you need to do that, simply replace
$text.html($.emoticons.replace($in.val())); with $text.html($.emoticons.replace($in.val().replace("<","&lt").replace(">","&gt"))); and you solved your problem :)

And you may need to redifine emoticons code for emoticon codes containing ["<",">"] , you replace those chars with ["&lt","&gt"]