Anything with user input I just use innerText. Or a simple escapeHTML function within the innerHTML - but I prefer innerText in a separate pass, as using escap

Anything with user input I just use innerText. Or a simple escapeHTML function within the innerHTML - but I prefer innerText in a separate pass, as using escapeHTML as a pattern gives an opportunity to forget to use it.