JavaScript 2025 · DOM and browser
Set text safely
textContent treats the value as plain text. innerHTML parses HTML.
element.textContent = userInput;
Caution: Setting innerHTML with untrusted input allows cross-site scripting. Use textContent unless you need HTML.
Official JavaScript 2025 documentation