These are more issues with how Javascript is handled on the web. I'd imagine that js sanitizers have gotten more sophisticated so the callback (first) example may be a bit weak; if you're accepting code from an unknown source, even if you're filtering it first, you're gonna have a bad time.