Using innerHTML with unsanitized data is bad.