Text Is Not HTML in JavaScript

A visitor's text can be anything, including text that looks like HTML. How you put it on the page decides what it becomes.

textContent puts text in an element: every character shows as it was typed, < and > too. innerHTML reads the string as HTML and builds real elements from it, with any onclick code inside them. A visitor who writes <b onclick="alert('gotcha')">Great</b> would get a live bold "Great" that runs their code when someone clicks it. This is called cross-site scripting: never put a visitor's text in innerHTML.

A small example, on a note paragraph:

const note = document.createElement("p");
note.textContent = "Use <b> for bold";
document.body.append(note);   // shows: Use <b> for bold

The shop gets a Reviews section. The check posts a review that hides code, then tries to click it:

> type "<b onclick="alert('gotcha')">Great</b>" into "Your review"
> click "Post review"
    list
      item: <b onclick="alert('gotcha')">Great</b>
    field "Your review": ""
> click "Great" in "Reviews"
    there is no button named "Great" in "Reviews"

Your task: find the review form, its text area and the #reviews list. On the form's submit, stop the browser's own sending, create an li whose textContent is the text area's value, add it to the end of the list and empty the text area.

Assignment
Follow the Coding Tutorial to post reviews into the Reviews list in app.js, as text and never as HTML.

Hint
Set the item's text before you empty the text area: after that, its value is "".