Escaping keeps user text as text
textContent treats the visitor's text as plain text: the browser escaped <, > and & for you, so the tags show literally and nothing runs.
Comments are notes in your HTML that the page doesn't show; character entities like < and & let you show characters that HTML would otherwise treat as code, which is also the basis of safe escaping.
Change the code and press Run (Ctrl+Enter). Predict what will happen first, then break it on purpose and read what changes. Your edits are saved and match the lesson page.
Ready for more? This phase has 5 hands-on exercises with automatic checks.
Practice questions
Write the code in the editor, run it, then open the model answer to compare.
Write a paragraph that shows exactly this text: Use <h1> once & only once.
Write a footer paragraph with a copyright sign, the year, the name Hectal, and a non-breaking space between Page and 1.
Add a comment above a heading explaining that it must match the page title.
Explain it without notes
Why do you need < and &? What goes wrong without them?
Are HTML comments safe for private notes? Why or why not?
What is the difference between a named entity and a numeric entity?
How does escaping protect a site against cross-site scripting?
Preview
Console
Nothing logged yet.Expected console output
Shown: I <b>love</b> this & that
Stored as HTML: I <b>love</b> this & that