if you use innerHTML the security people will have to audit the code. I think you can just use textContent here.