Is createTextNode completely safe from HTML injection & XSS?

user_76263 0
Viewed 5758

I'm working on a single page webapp. I'm doing the rendering by directly creating DOM nodes. In particular, all user-supplied data is added to the page by creating text nodes with document.createTextNode("user data").

Does this approach avoid any possibility of HTML injection, cross site scripting (XSS), and all the other evil things users could do?

web xss security html javascript
2 Answers

Yes, it's XSS safe, as would be using someElement.innerText = "...".

(The sibling answer adds confusion by including the XSS-vulnerable PHP snippet.)

user_41265140
Related