Say some "<script>do_bad_stuff();</script>" got through from some source you just expected to have text. (e.g. this happened for youtube the other day) If you

Say some "<script>do_bad_stuff();</script>" got through from some source you just expected to have text. (e.g. this happened for youtube the other day) If you insert this into the DOM with html(), it will execute the script, doing bad things. If you insert it into the dom with e.g. text(), it won't be interpreted.