How substituted values are escaped.
text
textContent
html
innerHTML
url
encodeURIComponent
/
?
#
&
../../evil
How substituted values are escaped.
text— none. The result reachestextContent, which is inert.html— escapeHtml. The result reachesinnerHTML.url—encodeURIComponent. The result is a URL that will be NAVIGATED to, so a value containing/,?,#or&must not be able to restructure it:../../evilin a label would otherwise traverse the target site's path.