title: Why isn't this XSS attack functioning?
body: <h2>Background</h2>
  
  <p>I'm building up a <a href="http://hackday.bitnamiapp.com/organisation-details.html?&amp;organisationId=531f63a246e29300025291ba" rel="nofollow">website</a> that lists organisations in my local area. The site is powered by an API and stores it's data in an instance of MongoDB.</p>
  
  <p>I'm fetching JSON from the API and dynamically building the content in Javascript.</p>
  
  <p>Now to test against XSS attacks I deliberately added some code to inject a Javascript alert into my page.</p>
  
  <p>But it's not working? Which obviously I'm happy about but I'm more confused as to why not.</p>
  
  <h2>The JSON</h2>
  
  <pre><code>{
  "_created": "Tue, 11 Mar 2014 19:27:30 GMT",
  "_etag": "fd8102613204000414cceff538771453b984a2c6",
  "_id": "531f63a246e29300025291ba",
  "_updated": "Tue, 11 Mar 2014 19:27:30 GMT",
  "description": "&lt;script&gt;alert('hello');&lt;/script&gt;",
  "tags": [
      "Antiques"
  ],
  "title": "HTML Injection",
  "url": "www.link.com"
  }
  </code></pre>
  
  <h2>the injected code</h2>
  
  <pre><code>&lt;script&gt;alert('hello');&lt;/script&gt;
  </code></pre>
  
  <h2>The code to retrieve the JSON and render it</h2>
  
  <pre><code>function S_GET(id) {
      var a = new RegExp(id+'=([^&amp;#=]*)');
      return decodeURIComponent(a.exec(window.location.search)[1]);
  }
  
  // retrieves languages and adds them to a list
  var organisationId = S_GET('organisationId');
  
  var url = 'http://damp-island-8192.herokuapp.com/organisations/' + organisationId;
  
  
  var dataRequest = new XMLHttpRequest();
  dataRequest.open('GET',url, false);
  dataRequest.onreadystatechange = processJSON;
  dataRequest.send();
  
  function processJSON() {
      if ( dataRequest.readyState == 4 &amp;&amp; dataRequest.status == 200 ) {    
          showJSON(dataRequest.responseText);
      }
  }
  
  function showJSON(input) {
  
      //dom elements
      var list = document.createElement('ul');
      list.setAttribute('id', 'organisation-details-list');
  
      var organisation = JSON.parse(input);
  
      // list organisation details
      // title
      var title = document.createElement('li');
      title.setAttribute('class', 'organisation-title');
      title.innerHTML = organisation.title;
      list.appendChild(title);
      // description
      var desc = document.createElement('li');
      desc.setAttribute('class', 'organisation-desc');
      desc.innerHTML = organisation.description;
      list.appendChild(desc);
      // link
      var link = document.createElement('li');
      link.setAttribute('class', 'organisation-link');
      var a = document.createElement('a');
      a.setAttribute('href', organisation.url);
      a.innerHTML = organisation.url;
      link.appendChild(a);
      list.appendChild(link);
  
  document.getElementsByClassName('organisation')[0].appendChild(list);
  };
  </code></pre>
  
  <h2>The HTML</h2>
  
  <pre><code>&lt;!DOCTYPE html&gt;
  &lt;head&gt;
      &lt;title&gt;Moving To Leicester&lt;/title&gt;
      &lt;link rel="stylesheet" type="text/css" href="css/styles.css"&gt;
  &lt;/head&gt;
  &lt;body&gt;
      &lt;div class="container"&gt;
          &lt;div class="header"&gt;
              &lt;ul class="nav nav-pills dropdown-menu-right"&gt;
                  &lt;li class="active"&gt;&lt;a href="splash-page.html"&gt;Home&lt;/a&gt;&lt;/li&gt;
                  &lt;li&gt;&lt;a href="#"&gt;About&lt;/a&gt;&lt;/li&gt;
                  &lt;li&gt;&lt;a href="#"&gt;Contact&lt;/a&gt;&lt;/li&gt;
              &lt;/ul&gt;
          &lt;/div&gt;
          &lt;div class="row padding-top-5"&gt;
              &lt;div class="col-md-2"&gt;
                  &lt;!--Sidebar content--&gt;
  
              &lt;/div&gt;
              &lt;div class="col-md-10"&gt;
                  &lt;!--Body content--&gt;
                  &lt;div class="organisation"&gt;&lt;/div&gt;
  
              &lt;/div&gt;
          &lt;/div&gt;
      &lt;/div&gt;
      &lt;script type="text/javascript" src="http://code.jquery.com/jquery-1.11.0.min.js"&gt;&lt;/script&gt;
      &lt;script src="//netdna.bootstrapcdn.com/bootstrap/3.1.1/js/bootstrap.min.js"&gt;&lt;/script&gt;
      &lt;script type="text/javascript" src="js/organisation-details-page.js"&gt;&lt;/script&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <h2>Question</h2>
  
  <p>Why doesn't the page trigger an alert when I'm viewing it?</p>