Skip to main content
PProfileMatch
Read Play
← Path

JavaScript Fundamentals · JavaScript DOM and Events: Select, Update and Respond to Clicks

0 XP
  1. 1 current stop: learning
  2. 2 upcoming
  3. 3 upcoming
  4. 4 upcoming
  5. 5 upcoming

Finish after stop 5

Stop 1 of 5 · Theatre box office window

Trick to keep in mind+3 XP

textContent shows it; innerHTML runs it

textContent takes a string literally, so <b> appears as the characters <b>. innerHTML (and outerHTML, insertAdjacentHTML) parse the string as markup, which means an attacker-supplied tag with an inline handler can execute script. For anything a user typed, use textContent or build nodes with createElement.

Read it once, then a question tests whether the trick stuck.