prevent code injection

Insert user-submitted text into DOM as a text node so that HTML tags cannot be included.