Bug 1102204 - Use textContent to avoid injecting html. r=kgrandon