mi proteggo da code injection

django/static/admin/js/autocomplete.js

@@ -47,7 +47,7 @@
                         }
                         container.classList.add(styleClass);
                     }
-                    return $('<span class="' + styleClass + '">' + item.text + '</span>');
+                    return $('<span class="' + styleClass + '"></span>').text(item.text);
                 }
             });
         });