users should not be able to inject html about todolist

[bboyle]

Review where the input is parsed: https://github.com/jtme/ToDolist/blob/gh-pages/script.js#L17
var add_value = $('input').val();

And inserted: https://github.com/jtme/ToDolist/blob/gh-pages/script.js#L18
var new_item = $("<li> <span class=\"item\">" + add_value + "</span></li>");

[bboyle]

I suggest something like this:

var user_input = $('input').val();
var clean_input = $('<div>').text(user_input).html();
var new_item = $("<li> <span class=\"item\">" + clean_input + "</span></li>");