Use textContent and innerText instead of innerHTML

Closes XSS vulnerability