I have a function creating an HTML/CSS MessageBox where I want to display a variable (already escaped with PHP json\_encode(), no XSS injection possible).
I want to display this variable in a hard-coded message, it is always the same message.
The message displays this variable between HTML bold tags `<b></b>`:

```
Message("Do you really want to delete <b>" + reference + "</b> ?");

```

The string passed to the Message() function will be added in a div tag and the only solution I have is to use innerHTML if I want the variable reference to be displayed with bold style.

A lot of people say "Do not use innerHTML it's not normalized", "It's a Microsoft proprietary function, it's not W3C and will maybe no longer be supported".

I've always used DOM methods but in my case, DOM1 myDiv.firstChild.nodeValue property or even DOM3 myDiv.textContent method will not work because the string is displayed as text only.

The innerHTML method has advantage to not escape `<>`characters with HTML entities and unfortunately I think it is not possible to get the same result with DOM methods.

I can't use document.createElement("b") method, it would complicate everything since in want my Message() function to get the full styled string as one parameter.

So my thought is that innerHTML need to be used in some case instead of complicating things and it is not a bad practise depending on how you use it.

Comments are appreciated.