title: DOM based XSS is possible in this example?
body: <p>I've been reading a bundle of documents about DOM based XSS but I still can't figure it out. Let's take a look at my example.</p>
  
  <pre><code>var html = `
      &lt;a class="url" href="${untrustedURL}"&gt;
          &lt;img src="${untrustedSource}"&gt;
      &lt;/a&gt;
      &lt;span class="name" data-value="${untrustedValue}"&gt;${untrustedText}&lt;/span&gt;
  `;
  document.querySelector('#user').innerHTML = html;
  </code></pre>
  
  <p>How can an attacker exploit the vulnerabilities of this code? And what are the solutions?</p>