JavaScript Security Best Practices

const userInput = document.getElementById('userInput').value;
document.getElementById('output').innerHTML = userInput;

Memory leak
Cross-Site Scripting (XSS)
This code demonstrates a Cross-Site Scripting (XSS) vulnerability by directly inserting user input into innerHTML without sanitization. An attacker could input malicious HTML or JavaScript that would then be executed in the user's browser. To prevent XSS, always sanitize user input and use safer alternatives like textContent for text or createElement() for HTML elements.
SQL Injection
Buffer overflow