diff --git a/src/pkg/exp/template/html/context.go b/src/pkg/exp/template/html/context.go
index 1a3fb44a3e..856d1c94eb 100644
--- a/src/pkg/exp/template/html/context.go
+++ b/src/pkg/exp/template/html/context.go
@@ -20,13 +20,20 @@ type context struct {
 	delim   delim
 	urlPart urlPart
 	jsCtx   jsCtx
+	element element
 	errLine int
 	errStr  string
 }
 
 // eq returns whether two contexts are equal.
 func (c context) eq(d context) bool {
-	return c.state == d.state && c.delim == d.delim && c.urlPart == d.urlPart && c.jsCtx == d.jsCtx && c.errLine == d.errLine && c.errStr == d.errStr
+	return c.state == d.state &&
+		c.delim == d.delim &&
+		c.urlPart == d.urlPart &&
+		c.jsCtx == d.jsCtx &&
+		c.element == d.element &&
+		c.errLine == d.errLine &&
+		c.errStr == d.errStr
 }
 
 // state describes a high-level HTML parser state.
@@ -47,6 +54,11 @@ const (
 	stateText state = iota
 	// stateTag occurs before an HTML attribute or the end of a tag.
 	stateTag
+	// stateComment occurs inside an <!-- HTML comment -->.
+	stateComment
+	// stateRCDATA occurs inside an RCDATA element (<textarea> or <title>)
+	// as described at http://dev.w3.org/html5/spec/syntax.html#elements-0
+	stateRCDATA
 	// stateAttr occurs inside an HTML attribute whose content is text.
 	stateAttr
 	// stateURL occurs inside an HTML attribute whose content is a URL.
@@ -87,6 +99,8 @@ const (
 var stateNames = [...]string{
 	stateText:        "stateText",
 	stateTag:         "stateTag",
+	stateComment:     "stateComment",
+	stateRCDATA:      "stateRCDATA",
 	stateAttr:        "stateAttr",
 	stateURL:         "stateURL",
 	stateJS:          "stateJS",
@@ -195,3 +209,38 @@ func (c jsCtx) String() string {
 	}
 	return fmt.Sprintf("illegal jsCtx %d", c)
 }
+
+// element identifies the HTML element when inside a start tag or special body.
+// Certain HTML element (for example <script> and <style>) have bodies that are
+// treated differently from stateText so the element type is necessary to
+// transition into the correct context at the end of a tag and to identify the
+// end delimiter for the body.
+type element uint8
+
+const (
+	// elementNone occurs outside a special tag or special element body.
+	elementNone element = iota
+	// elementScript corresponds to the raw text <script> element.
+	elementScript
+	// elementStyle corresponds to the raw text <style> element.
+	elementStyle
+	// elementTextarea corresponds to the RCDATA <textarea> element.
+	elementTextarea
+	// elementTitle corresponds to the RCDATA <title> element.
+	elementTitle
+)
+
+var elementNames = [...]string{
+	elementNone:     "elementNone",
+	elementScript:   "elementScript",
+	elementStyle:    "elementStyle",
+	elementTextarea: "elementTextarea",
+	elementTitle:    "elementTitle",
+}
+
+func (e element) String() string {
+	if int(e) < len(elementNames) {
+		return elementNames[e]
+	}
+	return fmt.Sprintf("illegal element %d", e)
+}
diff --git a/src/pkg/exp/template/html/escape.go b/src/pkg/exp/template/html/escape.go
index 929444eca0..d3c06bb7f6 100644
--- a/src/pkg/exp/template/html/escape.go
+++ b/src/pkg/exp/template/html/escape.go
@@ -104,7 +104,7 @@ func escapeAction(c context, n *parse.ActionNode) context {
 		s = append(s, "exp_template_html_jsstrescaper")
 	case stateJSRegexp:
 		s = append(s, "exp_template_html_jsregexpescaper")
-	case stateJSBlockCmt, stateJSLineCmt, stateCSSBlockCmt, stateCSSLineCmt:
+	case stateComment, stateJSBlockCmt, stateJSLineCmt, stateCSSBlockCmt, stateCSSLineCmt:
 		return context{
 			state:   stateError,
 			errLine: n.Line,
@@ -296,7 +296,9 @@ func escapeText(c context, s []byte) context {
 			// Consume any quote.
 			i++
 		}
-		c, s = context{state: stateTag}, s[i:]
+		// On exiting an attribute, we discard all state information
+		// except the state and element.
+		c, s = context{state: stateTag, element: c.element}, s[i:]
 	}
 	return c
 }
@@ -307,6 +309,8 @@ func escapeText(c context, s []byte) context {
 var transitionFunc = [...]func(context, []byte) (context, []byte){
 	stateText:        tText,
 	stateTag:         tTag,
+	stateComment:     tComment,
+	stateRCDATA:      tSpecialTagEnd,
 	stateAttr:        tAttr,
 	stateURL:         tURL,
 	stateJS:          tJS,
@@ -326,12 +330,17 @@ var transitionFunc = [...]func(context, []byte) (context, []byte){
 	stateError:       tError,
 }
 
+var commentStart = []byte("<!--")
+var commentEnd = []byte("-->")
+
 // tText is the context transition function for the text state.
 func tText(c context, s []byte) (context, []byte) {
 	for {
 		i := bytes.IndexByte(s, '<')
 		if i == -1 || i+1 == len(s) {
 			return c, nil
+		} else if i+4 <= len(s) && bytes.Equal(commentStart, s[i:i+4]) {
+			return context{state: stateComment}, s[i+4:]
 		}
 		i++
 		if s[i] == '/' {
@@ -340,16 +349,24 @@ func tText(c context, s []byte) (context, []byte) {
 			}
 			i++
 		}
-		j := eatTagName(s, i)
+		j, e := eatTagName(s, i)
 		if j != i {
 			// We've found an HTML tag.
-			return context{state: stateTag}, s[j:]
+			return context{state: stateTag, element: e}, s[j:]
 		}
 		s = s[j:]
 	}
 	panic("unreachable")
 }
 
+var elementContentType = [...]state{
+	elementNone:     stateText,
+	elementScript:   stateJS,
+	elementStyle:    stateCSS,
+	elementTextarea: stateRCDATA,
+	elementTitle:    stateRCDATA,
+}
+
 // tTag is the context transition function for the tag state.
 func tTag(c context, s []byte) (context, []byte) {
 	// Find the attribute name.
@@ -362,7 +379,7 @@ func tTag(c context, s []byte) (context, []byte) {
 		}, nil
 	}
 	if i == len(s) {
-		return context{state: stateTag}, nil
+		return c, nil
 	}
 	state := stateAttr
 	canonAttrName := strings.ToLower(string(s[attrStart:i]))
@@ -377,13 +394,14 @@ func tTag(c context, s []byte) (context, []byte) {
 	// Look for the start of the value.
 	i = eatWhiteSpace(s, i)
 	if i == len(s) {
-		return context{state: stateTag}, s[i:]
+		return c, s[i:]
 	}
 	if s[i] == '>' {
-		return context{state: stateText}, s[i+1:]
+		state = elementContentType[c.element]
+		return context{state: state, element: c.element}, s[i+1:]
 	} else if s[i] != '=' {
 		// Possible due to a valueless attribute or '/' in "<input />".
-		return context{state: stateTag}, s[i:]
+		return c, s[i:]
 	}
 	// Consume the "=".
 	i = eatWhiteSpace(s, i+1)
@@ -399,7 +417,38 @@ func tTag(c context, s []byte) (context, []byte) {
 		}
 	}
 
-	return context{state: state, delim: delim}, s[i:]
+	return context{state: state, delim: delim, element: c.element}, s[i:]
+}
+
+// tComment is the context transition function for stateComment.
+func tComment(c context, s []byte) (context, []byte) {
+	i := bytes.Index(s, commentEnd)
+	if i != -1 {
+		return context{}, s[i+3:]
+	}
+	return c, nil
+}
+
+// specialTagEndMarkers maps element types to the character sequence that
+// case-insensitively signals the end of the special tag body.
+var specialTagEndMarkers = [...]string{
+	elementScript:   "</script",
+	elementStyle:    "</style",
+	elementTextarea: "</textarea",
+	elementTitle:    "</title",
+}
+
+// tSpecialTagEnd is the context transition function for raw text and RCDATA
+// element states.
+func tSpecialTagEnd(c context, s []byte) (context, []byte) {
+	if c.element != elementNone {
+		end := specialTagEndMarkers[c.element]
+		i := strings.Index(strings.ToLower(string(s)), end)
+		if i != -1 {
+			return context{state: stateTag}, s[i+len(end):]
+		}
+	}
+	return c, nil
 }
 
 // tAttr is the context transition function for the attribute state.
@@ -419,8 +468,9 @@ func tURL(c context, s []byte) (context, []byte) {
 
 // tJS is the context transition function for the JS state.
 func tJS(c context, s []byte) (context, []byte) {
-	// TODO: delegate to tSpecialTagEnd to find any </script> once that CL
-	// has been merged.
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 
 	i := bytes.IndexAny(s, `"'/`)
 	if i == -1 {
@@ -453,8 +503,9 @@ func tJS(c context, s []byte) (context, []byte) {
 
 // tJSStr is the context transition function for the JS string states.
 func tJSStr(c context, s []byte) (context, []byte) {
-	// TODO: delegate to tSpecialTagEnd to find any </script> once that CL
-	// has been merged.
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 
 	quoteAndEsc := `\"`
 	if c.state == stateJSSqStr {
@@ -486,8 +537,9 @@ func tJSStr(c context, s []byte) (context, []byte) {
 
 // tJSRegexp is the context transition function for the /RegExp/ literal state.
 func tJSRegexp(c context, s []byte) (context, []byte) {
-	// TODO: delegate to tSpecialTagEnd to find any </script> once that CL
-	// has been merged.
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 
 	b := s
 	inCharset := false
@@ -536,7 +588,9 @@ var blockCommentEnd = []byte("*/")
 
 // tBlockCmt is the context transition function for /*comment*/ states.
 func tBlockCmt(c context, s []byte) (context, []byte) {
-	// TODO: look for </script or </style end tags.
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 	i := bytes.Index(s, blockCommentEnd)
 	if i == -1 {
 		return c, nil
@@ -554,7 +608,9 @@ func tBlockCmt(c context, s []byte) (context, []byte) {
 
 // tLineCmt is the context transition function for //comment states.
 func tLineCmt(c context, s []byte) (context, []byte) {
-	// TODO: look for </script or </style end tags.
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 	var lineTerminators string
 	var endState state
 	switch c.state {
@@ -588,7 +644,9 @@ func tLineCmt(c context, s []byte) (context, []byte) {
 
 // tCSS is the context transition function for the CSS state.
 func tCSS(c context, s []byte) (context, []byte) {
-	// TODO: look for </style
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 
 	// CSS quoted strings are almost never used except for:
 	// (1) URLs as in background: "/foo.png"
@@ -664,7 +722,9 @@ func tCSS(c context, s []byte) (context, []byte) {
 
 // tCSSStr is the context transition function for the CSS string and URL states.
 func tCSSStr(c context, s []byte) (context, []byte) {
-	// TODO: look for </style
+	if d, t := tSpecialTagEnd(c, s); t != nil {
+		return d, t
+	}
 
 	var endAndEsc string
 	switch c.state {
@@ -730,22 +790,25 @@ func eatAttrName(s []byte, i int) (int, os.Error) {
 	return len(s), nil
 }
 
-// eatTagName returns the largest j such that s[i:j] is a tag name.
-func eatTagName(s []byte, i int) int {
-	for j := i; j < len(s); j++ {
+var elementNameMap = map[string]element{
+	"script":   elementScript,
+	"style":    elementStyle,
+	"textarea": elementTextarea,
+	"title":    elementTitle,
+}
+
+// eatTagName returns the largest j such that s[i:j] is a tag name and the tag type.
+func eatTagName(s []byte, i int) (int, element) {
+	j := i
+	for ; j < len(s); j++ {
 		x := s[j]
-		switch {
-		case 'a' <= x && x <= 'z':
-			// No-op.
-		case 'A' <= x && x <= 'Z':
-			// No-op.
-		case '0' <= x && x <= '9' && i != j:
-			// No-op.
-		default:
-			return j
+		if !(('a' <= x && x <= 'z') ||
+			('A' <= x && x <= 'Z') ||
+			('0' <= x && x <= '9' && i != j)) {
+			break
 		}
 	}
-	return len(s)
+	return j, elementNameMap[strings.ToLower(string(s[i:j]))]
 }
 
 // eatWhiteSpace returns the largest j such that s[i:j] is white space.
diff --git a/src/pkg/exp/template/html/escape_test.go b/src/pkg/exp/template/html/escape_test.go
index 3294323409..efd97fced5 100644
--- a/src/pkg/exp/template/html/escape_test.go
+++ b/src/pkg/exp/template/html/escape_test.go
@@ -171,6 +171,11 @@ func TestEscape(t *testing.T) {
 			"<button onclick='alert({{.A}})'>",
 			`<button onclick='alert([&#34;\u003ca\u003e&#34;,&#34;\u003cb\u003e&#34;])'>`,
 		},
+		{
+			"jsObjValueScript",
+			"<script>alert({{.A}})</script>",
+			`<script>alert(["\u003ca\u003e","\u003cb\u003e"])</script>`,
+		},
 		{
 			"jsObjValueNotOverEscaped",
 			"<button onclick='alert({{.A | html}})'>",
@@ -214,13 +219,13 @@ func TestEscape(t *testing.T) {
 		},
 		{
 			"styleIDPassed",
-			`<style>p{{"#my-ID"}} { font: Arial }`,
-			`<style>p#my-ID { font: Arial }`,
+			`<style>p{{"#my-ID"}} { font: Arial }</style>`,
+			`<style>p#my-ID { font: Arial }</style>`,
 		},
 		{
 			"styleClassPassed",
-			`<style>p{{".my_class"}} { font: Arial }`,
-			`<style>p.my_class { font: Arial }`,
+			`<style>p{{".my_class"}} { font: Arial }</style>`,
+			`<style>p.my_class { font: Arial }</style>`,
 		},
 		{
 			"styleQuantityPassed",
@@ -302,6 +307,16 @@ func TestEscape(t *testing.T) {
 			`<a style="background: '{{"http://oreilly.com/O'Reilly Animals(1)<2>;{}.html"}}'">`,
 			`<a style="background: 'http\3a\2f\2foreilly.com\2fO\27Reilly Animals\28 1\29\3c 2\3e\3b\7b\7d.html'">`,
 		},
+		{
+			"styleURLEncodedForHTMLInAttr",
+			`<a style="background: url('{{"/search?img=foo&size=icon"}}')">`,
+			`<a style="background: url('/search?img=foo&amp;size=icon')">`,
+		},
+		{
+			"styleURLNotEncodedForHTMLInCdata",
+			`<style>body { background: url('{{"/search?img=foo&size=icon"}}') }</style>`,
+			`<style>body { background: url('/search?img=foo&size=icon') }</style>`,
+		},
 		{
 			"styleURLMixedCase",
 			`<p style="background: URL(#{{.H}})">`,
@@ -324,13 +339,19 @@ func TestEscape(t *testing.T) {
 			`<a style="border-image: url({{"/**/'\";:// \\"}}), url(&quot;{{"/**/'\";:// \\"}}&quot;), url('{{"/**/'\";:// \\"}}'), 'http://www.example.com/?q={{"/**/'\";:// \\"}}''">`,
 			`<a style="border-image: url(/**/%27%22;://%20%5c), url(&quot;/**/%27%22;://%20%5c&quot;), url('/**/%27%22;://%20%5c'), 'http://www.example.com/?q=%2f%2a%2a%2f%27%22%3b%3a%2f%2f%20%5c''">`,
 		},
+		{
+			"comment",
+			"<b>Hello, <!-- name of world -->{{.C}}</b>",
+			// TODO: Elide comment.
+			"<b>Hello, <!-- name of world -->&lt;Cincinatti&gt;</b>",
+		},
 	}
 
 	for _, test := range tests {
 		tmpl := template.Must(template.New(test.name).Parse(test.input))
-		tmpl, err := Escape(tmpl)
+		tmpl = template.Must(Escape(tmpl))
 		b := new(bytes.Buffer)
-		if err = tmpl.Execute(b, data); err != nil {
+		if err := tmpl.Execute(b, data); err != nil {
 			t.Errorf("%s: template execution failed: %s", test.name, err)
 			continue
 		}
@@ -410,6 +431,10 @@ func TestErrors(t *testing.T) {
 			"<a b=1 c={{.H}}",
 			"z ends in a non-text context: {stateAttr delimSpaceOrTagEnd",
 		},
+		{
+			"<script>foo();",
+			"z ends in a non-text context: {stateJS",
+		},
 		{
 			`<a href="{{if .F}}/foo?a={{else}}/bar/{{end}}{{.H}}">`,
 			"z:1: (action: [(command: [F=[H]])]) appears in an ambiguous URL context",
@@ -446,6 +471,10 @@ func TestErrors(t *testing.T) {
 			`<a style="// color: {{.X}}">`,
 			`z:1: (action: [(command: [F=[X]])]) appears inside a comment`,
 		},
+		{
+			"<!-- {{.H}} -->",
+			"z:1: (action: [(command: [F=[H]])]) appears inside a comment",
+		},
 	}
 
 	for _, test := range tests {
@@ -765,6 +794,94 @@ func TestEscapeText(t *testing.T) {
 			`<a style="background: url( x `,
 			context{state: stateCSS, delim: delimDoubleQuote},
 		},
+		{
+			`<!-- foo`,
+			context{state: stateComment},
+		},
+		{
+			`<!-->`,
+			context{state: stateComment},
+		},
+		{
+			`<!--->`,
+			context{state: stateComment},
+		},
+		{
+			`<!-- foo -->`,
+			context{state: stateText},
+		},
+		{
+			`<script`,
+			context{state: stateTag, element: elementScript},
+		},
+		{
+			`<script `,
+			context{state: stateTag, element: elementScript},
+		},
+		{
+			`<script src="foo.js" `,
+			context{state: stateTag, element: elementScript},
+		},
+		{
+			`<script src='foo.js' `,
+			context{state: stateTag, element: elementScript},
+		},
+		{
+			`<script type=text/javascript `,
+			context{state: stateTag, element: elementScript},
+		},
+		{
+			`<script>foo`,
+			context{state: stateJS, jsCtx: jsCtxDivOp, element: elementScript},
+		},
+		{
+			`<script>foo</script>`,
+			context{state: stateText},
+		},
+		{
+			`<script>foo</script><!--`,
+			context{state: stateComment},
+		},
+		{
+			`<script>document.write("<p>foo</p>");`,
+			context{state: stateJS, element: elementScript},
+		},
+		{
+			`<script>document.write("<p>foo<\/script>");`,
+			context{state: stateJS, element: elementScript},
+		},
+		{
+			`<script>document.write("<script>alert(1)</script>");`,
+			context{state: stateText},
+		},
+		{
+			`<Script>`,
+			context{state: stateJS, element: elementScript},
+		},
+		{
+			`<SCRIPT>foo`,
+			context{state: stateJS, jsCtx: jsCtxDivOp, element: elementScript},
+		},
+		{
+			`<textarea>value`,
+			context{state: stateRCDATA, element: elementTextarea},
+		},
+		{
+			`<textarea>value</TEXTAREA>`,
+			context{state: stateText},
+		},
+		{
+			`<textarea name=html><b`,
+			context{state: stateRCDATA, element: elementTextarea},
+		},
+		{
+			`<title>value`,
+			context{state: stateRCDATA, element: elementTitle},
+		},
+		{
+			`<style>value`,
+			context{state: stateCSS, element: elementStyle},
+		},
 	}
 
 	for _, test := range tests {