Web Security · Junior · Question 20 of 75

Which line safely shows a user's name in an element?

const name = new URLSearchParams(location.search).get('name');

1el.innerHTML = name;
✓Correct answer: el.textContent = name;
3el.outerHTML = '<b>' + name + '</b>';

Explanation

textContent treats the value as plain text. innerHTML and outerHTML parse it as HTML, so <img src=x onerror=...> would run code.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.