Use textContent and innerText instead of innerHTML

Closes XSS vulnerability

Regrettably, IE <=8 doesn't support textContent, so I included a fallback to innerText (which isn't supported by modern browsers in turn)

For an example of XSS, see https://planetcyborg.de/np/?g=69e3b4#mIgpVK4x