don't add plain text with innerHTML, use text nodes instead