Does 'innerText' prevent XSS?

Question

If I am going to be displaying user-generated input on my site, is it safe enough to just display it by doing Element.innerText = \"user input\" in javascript,

Answer 1

Does 'innerText' prevent XSS?

Not in all cases! The following excerpt is from the OWASP Foundation regarding unsafe usages of innerText:

One example of an attribute which is thought to be safe is innerText. Some papers or guides advocate its use as an alternative to innerHTML to mitigate against XSS in innerHTML. However, depending on the tag which innerText is applied, code can be executed.

The content provides the following example (which I have modified for clarity)

const tag = document.createElement("script");
tag.innerText = `console.log('Inner Text Used')`;
document.body.appendChild(tag); //executes code

---

However, in MOST cases, innerText is the method you would use to prevent XSS, and is also documented on OWASP:

... use innerText/textContent. This will solve the problem, and it is the right way to re-mediate DOM based XSS vulnerabilities