JavaScript · Junior · Question 39 of 75
Why is textContent safer than innerHTML for displaying user text?
- ✓Correct answer: It inserts text as is, without parsing HTML - XSS is impossible
- 2It automatically strips all dangerous words and characters from the string
- 3It's faster, while both are equally safe
Explanation
el.innerHTML = userInput parses the string as markup, and <img src=x onerror=alert(1)> runs a script. textContent shows tags as text. If you really need HTML, clean it with a sanitizer (DOMPurify).