sinejoe commented on Allowing a customer to edit their profile and metadata

Values are stored as they are sent. You can either check and force-escape anything you want before POSTing in your JS or you can use the {{ val | escape }} filter in liquid to help prevent injection of any <script> or other markup.