On: DOMPurify bypass: XSS via HTML namespace confusion

[continuational]

You simply never use string concatenation to produce HTML, CSS, JS, SQL, etc.

Instead, use e.g. an HTML library that automatically escapes strings. Then you don't even have to think about it.