JS selectors aren't escaped properly

The D7 version is supposed to be usable as a Form API element. However, currently the field name is injected unfiltered into the class attribute, and then into a class selector. That works with Field API identifiers, but Form API identifiers are a little more flexible - in particular, they can contain square brackets, periods and other special selector characters.

I was able to get it to work by replacing the "_sel" and "_unsel" classes with a "data-multiselect" attribute that always contained the field name. (This also replaces the duplicate ID attributes that currently break validation.)

Then, the JS code does something like this instead of constructing the separate class selectors:

  function escapeSelector(s) {
    return s.replace(/([:.\[\],=])/g, "\\$1");
  }

//...

        var name = escapeSelector($(this).attr('data-multiselect'));
        var selector = 'select[data-multiselect="' + name + '"]';

        var unsel = $(selector + '.multiselect_unsel');
        var sel = $(selector + '.multiselect_sel');

(Can't make a decent patch against the dev version right now, sorry.)