title: Preventing HTML and Script injections in Javascript
body: <p>Assume I have a page with an input box. The user types something into the input box and hits a button. The button triggers a function that picks up the value typed into the text box and outputs it onto the page beneath the text box for whatever reason.</p>
  
  <p>Now this has been disturbingly difficult to find a definitive answer on or I wouldn't be asking but how would you go about outputting this string: </p>
  
  <pre><code>&lt;script&gt;alert("hello")&lt;/script&gt; &lt;h1&gt; Hello World &lt;/h1&gt;
  </code></pre>
  
  <p>So that neither the script is executed nor the HTML element is displayed? </p>
  
  <p>What I'm really asking here is if there is a standard method of avoiding both HTML and Script injection in <strong>Javascript</strong>. Everyone seems to have a different way of doing it (I'm using jQuery so I know I can simply output the string to the <em>text</em> element rather than the <em>html</em> element for instance, that's  not the point though).</p>