What is innerHTML & how does it work?

The innerHTML property can be used to examine the current HTML source of the page, including any changes that have been made since the page was initially loaded. Reading innerHTML causes the user agent to serialize the HTML or XML fragment comprised of the element's descendants. The resulting string is returned.

How do I clear the innerHTML?

But it clears the innerHTML as it is at the moment the code is ran. As you run the code before the images and the script are actually in the body, it tries to clear the body, but there's nothing to clear. If you want to clear the body, you have to run the code after the body has been filled with content.

Can a script> tag inserted with innerHTML execute JavaScript?

HTML specifies that a tag inserted with innerHTML should not execute . However, there are ways to execute JavaScript without using elements, so there is still a security risk whenever you use innerHTML to set strings over which you have no control. For example:

Is innerHTML a cross-site scripting attack?

It is not uncommon to see innerHTML used to insert text into a web page. There is potential for this to become an attack vector on a site, creating a potential security risk. Although this may look like a cross-site scripting attack, the result is harmless. HTML specifies that a tag inserted with innerHTML should not execute .