# Keeping Pages Safe: XSS and innerHTML

When a page puts someone else's text into innerHTML, that text can become code that runs in every visitor's browser, so you show it with textContent and createElement instead, and you keep secrets off the front end altogether.

![Cheat sheet: Keeping Pages Safe: XSS and innerHTML](https://fsdtrainingmedia.blob.core.windows.net/public/images/2026/10/9daa608fd5a44e4dad07af03ced6e420.webp)

- Category: JavaScript
- Level: Journeyman
- Tags: API Key, createElement(), innerHTML, JavaScript, textContent, web-development
- Updated: November 1, 2026

Source: https://www.ask-codey.com/cheat-sheets/javascript-security-xss-and-innerhtml-cheat-sheet