There are relatively few DOM APIs which take a trusted string. innerHTML and outerHTML are two and clearly state that they take <i>HTML</i> so it&#x27;s no surprise for the stuff you give them to be interpreted thus. But if you use e.g. textContent or createTextNode to insert text into your document, they will correctly sanitise it.<p>jQuery has text()[0], but because most of its API takes strings to start with, it&#x27;s very convenient to do the wrong thing and shove untrusted strings into unsafe methods.<p>[0] <a href="http:&#x2F;&#x2F;api.jquery.com&#x2F;text&#x2F;#text2" rel="nofollow">http:&#x2F;&#x2F;api.jquery.com&#x2F;text&#x2F;#text2</a>