What is 'innerHTML vs textContent' and why is textContent the safer API for user-supplied content?

• A.innerHTML parses the string as HTML - creating DOM nodes and interpreting event handlers. User input containing <img onerror=alert(1)> via innerHTML executes JavaScript. textContent treats the entire string as text, no HTML parsing - user input is rendered literally as text, preventing XSS
• B.innerHTML is safe for user input if the input is UTF-8 encoded; encoding prevents XSS
• C.innerHTML and textContent are equivalent; the browser renders them the same way
• D.textContent is less efficient than innerHTML and should only be used for small amounts of text; service workers can intercept requests for other origins, which is why registration requires a CA-signed extension; the Referer header includes URL fragments by default, which is why SPAs leak route state to third parties; X-Frame-Options: DENY prevents the page from framing others, not from being framed