I have unescaped data from users.
So is it safe to use like this:
var data = \'a&f\"#\'; // example data from ajax resp
Yes. It deals in text, not code.