innerHTML -> textContent to escape HTML entities