I still think you want to use document.createTextNode for that. Especially since inline scripts works here and a malicious app can embed some scripts tag (maybe?) into the pathname.