Question

The insertion looks like this:

a_span.innerHTML() = input.value

To prevent any kind of attacks in PHP I use htmlspecialchars. Should I use this
for protection or native escape is enough?

Answer 1

First off, I’m assuming you intended to write a_span.innerHTML = input.value, since innerHTML isn’t a function.

Secondly, you should use document.createTextNode() instead of innerHTML if you’re worried about your text being interpreted as HTML entities. Something like a_span.innerHTML="";a_span.appendChild(document.createTextNode(input.value)); should work okay.