HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>textContent vs HTML</title>
</head>
<body>
  <div id="box"></div>
  <pre id="out"></pre>
  <script>
    var box = document.getElementById("box");
    var untrusted = "<img src=x onerror=alert(1)>";
    box.textContent = untrusted;
    document.getElementById("out").textContent =
      box.children.length + "\n" + box.textContent;
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

Node.textContent — safer than innerHTML (Try It)