That's not quite true about security. There is a very bad practice some ajaxy sites have where they select parts of the page using `$(location.hash)` [1]. Since

That's not quite true about security. There is a very bad practice some ajaxy sites have where they select parts of the page using `$(location.hash)` [1]. Since that string is in the URL and entirely in control of outside code, it's pretty easy to get the page to run something that might send information to a third party. That particular hole was closed in jQuery 1.6.4 but there are still plenty of people running older versions. We're tightening this down even further in 1.9 to prevent a few other cases, which I am sure will break some code, but the only real solution is good input hygiene and HTML escaping on the part of the application itself. [1] http://jsfiddle.net/dmethvin/uKYUP/ http://jsfiddle.net/dmethvin/uKYUP/