dillon1000/react

Don't keep the HTML escaped ID internally, only in HTML generation

A dynamic value can be provided as a key to a child. Either as part of an object
or key property. This becomes part of the component's ID.

We have to be careful to escape this key before inserting it into the DOM since
it could become a vulnerability. We fixed this by escaping just the keys.

However, the current implementation breaks when you used escaped keys. The
internal value is escaped and the value used by getAttributeNode and
getElementById are both unescaped.

This fixes that by keeping the unescaped value internally but escaping it right
before the HTML is generated (like any other attribute).

This is important since business logic IDs (that should be used as keys)
contains characters that need to be escaped.