Escape to HTML-entities when assigning text to innerHTML.