Render user-supplied player names as text, never executable markup
The practical problem
A leaderboard that writes a nickname into innerHTML can interpret tags and event handlers supplied by a player.
Implementation protocol
Use textContent for untrusted values and create trusted elements through DOM APIs. Validate length and display normalization before storing any nickname.
Worked scenario
A name containing <img> must appear literally as text, not create an image or attempt script execution after reload.
What could go wrong
Client-side validation can be bypassed by directly calling a server endpoint.
Acceptance criteria
Verify server-side constraints and all later rendering contexts.
Source material and evidence boundaries
For the topic Render user-supplied player names as text, never executable markup, use the sources listed below to check relevant methods. Any worked figures illustrate a scenario, not measured MojPlayWin performance. Consult the shared evidence standards before applying the method.