jquery xss prevention when using html()

Question

I have this line of code with jquery, and I have been told that this line is vulnerable to xss, because I didn't escape the raw data before inject it using html() function.

Please let me know how to escape the data to make it more secure. (I can use javascript instead if that would solve the problem ie. get element by id etc.)

var data= "Some data from user or elsewhere";

$("output_area").html(data);

Answer 1

You'd have to use:

$("output_area").text(data)

If you want to inject HTML code, then you'd need to extract from the data and adding them as texts to HTML code that you yourself construct ($('<p/>').text(extractedParagraph), etc).