The description said the option allows user to determine whether to escape the Apex method’s response.
And, actually, it doesn't "escape" the respone, but "encode" or "not encode" the response.
Am I right?
When the remote action like this:
@RemoteAction
WebService static string showmsg(){
return '<script>alert(\'Hello\')</script>';
}
With escape:false
showMsg() is <script>alert('Hello')</script>
With escape:true
showMsg() is <script>alert('Hello')</script>
Just try difference characters, and find actually it only encode "
=> "
and <
=> <
and >
=> &rt;
And, it DOESN'T encode the two escape characters : '
and \