From the standpoint of Security vulnerability, is there any solution for replacing innerHTML
example
td.innerHTML = "<b>"+change_obj["old_end_cust_id"]+"</b>," + "<br>" + change_obj["old_address"].join(",<br>")
We tried directly creation javascript elements as shown below, it works but a lengthy process
var parentDivTag11 = document.createElement("div");
var parentBoldTag11 = document.createElement("b");
parentBoldTag11.textContent = change_obj["old_end_cust_id"]+",";
parentDivTag11.appendChild(parentBoldTag11);
for (let i = 0; i < change_obj["old_address"]?.length; i++) {
var divTag11 = document.createElement("div");
divTag11.textContent=change_obj["old_address"][i]+",";;
parentDivTag11.append(divTag11);
}
td.appendChild(parentDivTag11);
textContentis the best way to do it.textContentis the safest but you can try escaping the input.DOMParserand then attach the returned elements. The DOMParser does not parse scripts.