Browser & Web Performance · Junior · Question 60 of 75

Which way of putting user input into the page is safe from XSS?

✓Correct answer: el.textContent = userInput
2el.innerHTML = userInput
3document.write(userInput)

Explanation

textContent treats the value as text, so <script> or <img onerror> are just characters, not markup.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.