Content
Change what an element displays.
const el = document.querySelector(".card"); // textContent — plain text (SAFE): el.textContent = "Hello, World!"; el.textContent; // reads all text, ignores HTML tags // innerHTML — parses HTML (DANGEROUS with user input): el.innerHTML = "<strong>Bold</strong> text"; el.innerHTML; // returns HTML string including tags // innerText — visible text only (respects CSS): el.innerText; // ignores hidden elements, adds newlines // outerHTML — includes the element itself: el.outerHTML; // "<div class='card'><strong>Bold</strong> text</div>"
textContent ✓
Safe for user input
No XSS risk
innerHTML ⚠️
XSS risk with user data
Never use unsanitized input