title: html() vs innerHTML jquery/javascript & XSS attacks
body: <p>I'm testing xss attacks on my own code. The example beneath is a simple box where an user can type whatever he wants. After pressing "test!" button, JS will show the input string into  two divs.This is an example I made to explain better my question:</p>
  
  <pre><code>&lt;html&gt;
  &lt;script src="http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js"&gt;&lt;/script&gt;
  &lt;script type="text/javascript"&gt;
      function testIt(){
          var input = document.getElementById('input-test').value;
          var testHtml = document.getElementById('test-html');
          var testInnerHTML = document.getElementById('test-innerHTML');
          $(testHtml).html(input);
          testInnerHTML.innerHTML = input;
      }
  &lt;/script&gt;
  &lt;head&gt;this is a test&lt;/head&gt;
  &lt;body&gt;  
      &lt;input id="input-test" type="text" name="foo" /&gt;
      &lt;input type="button" onClick="testIt();" value="test!"/&gt;
      &lt;div id="test-html"&gt;
      &lt;/div&gt;
      &lt;div id="test-innerHTML"&gt;
      &lt;/div&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p></p>
  
  <p>if you try to copy it into a .html file and run it, it will work fine, but if you try to input <code>&lt;script&gt;alert('xss')&lt;/script&gt;</code>, only one alert box will be thrown: the one inside `test-html' div (with html() function).</p>
  
  <p>I really can't understand why this is happening, and also, inspecting the code with firebug gives me this result (after injecting the script)</p>
  
  <pre><code>&lt;body&gt;
  this is a test
  &lt;input id="input-test" type="text" name="foo"&gt;
  &lt;input type="button" value="test!" onclick="testIt();"&gt;
  &lt;div id="test-html"&gt; &lt;/div&gt;
  &lt;div id="test-innerHTML"&gt;
    &lt;script&gt;
      alert('xss')
    &lt;/script&gt;
  &lt;/div&gt;
  &lt;/body&gt;
  </code></pre>
  
  <p>as you can see <code>test-html</code> div is empty, and <code>test-innerhtml</code> div contans the script. Can someone tell me why? Is because html() is more secure against scripts injection or something similar?</p>
  
  <p>Thanks in advance, best regards.</p>