title: Prevent script injection with innerHTML
body: <p>I have written a micro-templating utility that uses innerHTML to inject html fragments in a Web page, based on user input (either plain text strings or html strings).</p>
  
  <p>My main concern is the risk of malicious script injection. The script could be injected via a script tag, or in an inline event (img onload, div onmouseover for example).</p>
  
  <p>Is there a way to sanitize the html string to prevent such injections? Also, are there other script injection methods I should be aware of?</p>