JavaScript 的模板字符串如何安全地嵌入用户输入以防止 XSS 攻击？

<font color="#0000FF">function escapeHtml(str) {
  const div = document.createElement('div');
  div.textContent = str;
  return div.innerHTML;
}

const userInput = '<script>alert("xss")</script>';
const safeOutput = `<p>${escapeHtml(userInput)}</p><p><span>立即学习</span>“<a href="https://pan.quark.cn/s/c1c2c2ed740f" style="text-decoration: underline !important; color: blue; font-weight: bolder;" rel="nofollow" target="_blank">Java免费学习笔记（深入）</a>”；</p>`;
// 结果：<p><script>alert("xss")</script></p>
                    <div class="aritcle_card">
                        <a class="aritcle_card_img" href="/ai/1087">
                            <img src="https://img.php.cn/upload/ai_manual/001/503/042/68b6c8cce8678848.png" alt="必剪Studio">
                        </a>
                        <div class="aritcle_card_info">
                            <a href="/ai/1087">必剪Studio</a>
                            <p>Bilibili发布的免费AI数字分身定制和视频创作工具</p>
                            <div class="">
                                <img src="/static/images/card_xiazai.png" alt="必剪Studio">
                                <span>183</span>
                            </div>
                        </div>
                        <a href="/ai/1087" class="aritcle_card_btn">
                            <span>查看详情</span>
                            <img src="/static/images/cardxiayige-3.png" alt="必剪Studio">
                        </a>
                    </div>
                
</font>

<font color="#0000FF">const element = document.getElementById('output');
element.textContent = `欢迎，${userInput}`; // 安全
</font>

<font color="#0000FF">const p = document.createElement('p');
p.textContent = userInput;
document.body.appendChild(p);
</font>