Comment by insanitybit

> In the case of writing to the DOM, that means you use .innerText rather than .innerHTML.

This is even enforceable with Trusted Types.