Content
Change what an element displays.
const el = document.querySelector(".card");
// textContent — plain text (SAFE):
el.textContent = "Hello, World!";
el.textContent; // reads all text, ignores HTML tags
// innerHTML — parses HTML (DANGEROUS with user input):
el.innerHTML = "<strong>Bold</strong> text";
el.innerHTML; // returns HTML string including tags
// innerText — visible text only (respects CSS):
el.innerText; // ignores hidden elements, adds newlines
// outerHTML — includes the element itself:
el.outerHTML; // "<div class='card'><strong>Bold</strong> text</div>"textContent ✓
Safe for user input
No XSS risk
innerHTML ⚠️
XSS risk with user data
Never use unsanitized input