If you&#x27;re assigning untrusted text to a property called `innerHTML`, you shouldn&#x27;t be surprised to learn that you&#x27;re vulnerable to XSS.<p>APIs like jQuery are worse because you end up treating strings as HTML without even realizing it. Example from the article:<p><pre><code>  $(&quot;#tail-here&quot;).prepend(newlines);
</code></pre>
There&#x27;s no hint on that line that the `newlines` variable is interpreted as HTML instead of text.