Agreed on the escaping. Alternatively, if you have content you want to remove HTML from before displaying, don't generate rich DOM nodes for that content, imme

Agreed on the escaping. Alternatively, if you have content you want to remove HTML from before displaying, don't generate rich DOM nodes for that content, immediately stick it into a TextNode and insert that into the DOM. Per the example in the OP, div.textContent will remove the "first level" of HTML, and leave what looks like tags, as the characters are unescaped. So just display this as an actual TextNode. It will show the <script> string in-line (I say string here, because it's not actually a tag, since it's in a TextNode), but that's actually the content the author intended by having it escaped in the input.