Well, I do for JS what I do for SQL. I just don't concatenate strings to create HTML code. No innerHTML, no nothing. let a = document.createElement('a');

Well, I do for JS what I do for SQL. I just don't concatenate strings to create HTML code. No innerHTML, no nothing. let a = document.createElement('a'); a.textContent = whateverText; a.href = whateverUrl; // XXX: check for schema Done. You may need like one 60 line function to make this less verbose when dealing with many elements. And you can forget about XSS, mostly. You can even disable innerHTML and friends if you want assurances: Object.defineProperty(HTMLElement.prototype, 'innerHTML', {value: '', writable: false});