Correctly (HTML) encoded values can lead to XSS when re-used in JavaScript context

index.html

// Value = <h1>Hello</h1>

<!-- Assuming {Value} will be correctly encoded for HTML attribute context -->
<a href="/foo" id="foo" title="{Value}">{Value}</a>

<div id="targetEl"></div>


<script>
  // This kind of JS can still lead to XSS
  var title = jQuery("#foo").attr("title");
  // jQuery inserts the plain HTML into the DOM and even evaluates <script> tags
  jQuery("#targetEl").html(title);
</script>