Why should you care?

MarkupVerse never echoes account nicknames with innerHTML on banking pages.

See it live — copy this example

Save as demo.html and open in your browser, or use Run Example below.

<div id="greeting"></div>
<script>
const nickname = '<img src=x onerror=alert(1)>'; // simulated attack
const el = document.getElementById('greeting');
el.textContent = 'Hello, ' + nickname; // safe
// el.innerHTML = 'Hello, ' + nickname; // NEVER with user data
</script>

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• textContent escapes markup.
• innerHTML with user/API data is the top XSS footgun.
• Encode on output.

Practice next

1. Use textContent for user strings.
2. Comment why innerHTML is banned.
3. Test with a script payload string.
4. Add DOMPurify if HTML rich text is required.
5. Set Content-Security-Policy header.

Remember

textContent not innerHTML. Encode server-side too. CSP as backup.

MarkupVerse safe greeting

Malicious nickname in profile API.

Outcome: textContent shows literal tags, no script run.