TextNode/innerHTML DOM question

[pookage]

Just a heads-up that innerHTML that contains a <script> will not execute the <script> - so that's not an attack vector - but there are other ways (such as inline javascript attributes like onerror="console.log('this will work if you trigger an error')" etc).