Try it out:
encodeURIComponent(\"\'@#$%^&\");
If you try this out you will see all the special characters are encoded except for the single
I found a neat trick that never misses any characters. I tell it to replace everything except for nothing. I do it like this (URL encoding):
function encode(w){return w.replace(/[^]/g,function(w){return '%'+w.charCodeAt(0).toString(16)})}
function encode(w){return w.replace(/[^]/g,function(w){return '%'+w.charCodeAt(0).toString(16)})}
loader.value = encode(document.body.innerHTML);