I don't see the upside to the effort of porting to js. You still have all of the same pittfalls. Yes, you can build a DOM with 20x the code and 1/20th the performance ... or you can just call htmlspeciachars() in php. Yup, security is tedious and you need to stay on your toes.