Use textContent and innerText instead of innerHTML

Closes XSS vulnerability
Merge pull request #1 from jplitza/master

Use textContent and innerText instead of innerHTML