Use textContent and innerText instead of innerHTML

Closes XSS vulnerability

Regrettably, IE <=8 doesn't support textContent, so I included a fallback to innerText (which isn't supported by modern browsers in turn)