Prevent unsafe HTML injection

The problem

Rendering user input with innerHTML can turn ordinary labels into executable markup.

Practical procedure

Use textContent and createElement for user-controlled values, including imported report labels.

Worked scenario

The string '<img onerror=alert(1)>' must display as text, never as an element.

Acceptance check

Review DOM write sites and test that untrusted strings cannot become executable HTML.

Apply the method

Use the related interactive tool to try the concept on an inspectable example. Record the starting assumptions and expected result before changing settings, then compare what the tool actually does. Where the result differs, keep the release marked experimental and document the discrepancy.

Further reading: Relevant primary technical documentation. This guide is an educational procedure, not a substitute for independent usability or compliance review.