title: How to grab only the text of HTML elements in a safe and secure way
body: <p>So <code>"&lt;h1&gt;Hello World&lt;/h1&gt;"</code> will just return 'Hello World'.  </p>
  
  <p>I've tried: </p>
  
  <pre><code>$('&lt;div&gt;').html('&lt;h1&gt;Hello World&lt;/h1&gt;').text()
  </code></pre>
  
  <p>And that works fine in most cases, but it does open up an xss vulnerability for when the string is something like this: <code>&lt;img src=1 onerror=alert(/XSS/)&gt;</code>, when I expect it to return an empty string</p>