Every time you use innerHTML a security engineer will have to look at your code.  Use textContent whenever possible.