Due to inconsistencies in the way innerHTML works, we need to manually escape this raw HTML ourselves to prevent XSS