code: function htmlSanitizeWriter(buf, options){
   var ignore = false;
   var out = bind(buf, buf.push);
   return {
    start: function(tag, attrs, unary){
     tag = lowercase(tag);
     if (!ignore && specialElements[tag]) {
      ignore = tag;
     }
     if (!ignore && validElements[tag] == true) {
      out('<');
      out(tag);
      if (invalidIframeSource(tag, attrs, options)) {
        delete attrs.src;
      }
      forEach(attrs, function(value, key){
       var lkey=lowercase(key);
       if (validAttrs[lkey]==true && (uriAttrs[lkey]!==true || value.match(URI_REGEXP))) {
        out(' ');
        out(key);
        out('="');
        out(he.encode(value));
        out('"');
       }
      });
      out(unary ? '/>' : '>');
     }
    },
    end: function(tag){
      tag = lowercase(tag);
      if (!ignore && validElements[tag] == true) {
       out('</');
       out(tag);
       out('>');
      }
      if (tag == ignore) {
       ignore = false;
      }
     },
    chars: function(chars){
      if (!ignore) {
       out(he.encode(chars));
      }
     }
   };
  }
docs: Escapes all potentially dangerous characters, so that the
  resulting string can be safely inserted into attribute or
  element text.
  @param value
  @returns escaped text
   /*
  function encodeEntities(value) {
  return value.
  replace(/&/g, '&amp;').
  replace(NON_ALPHANUMERIC_REGEXP, function(value){
  return '&#' + value.charCodeAt(0) + ';';
  }).
  replace(/</g, '&lt;').
  replace(/>/g, '&gt;');
  } 
  create an HTML/XML writer which writes to buffer
  @param {Array} buf use buf.jain('') to get out sanitized html string
  @returns {object} in the form of {
  start: function(tag, attrs, unary) {},
  end: function(tag) {},
  chars: function(text) {},
  comment: function(text) {}
  }