Chapters

Getting startedChapter 3 of 21

Output

The four ways to show something, and which one to reach for.

JavaScript has no print. Showing something means choosing where it should go: the console for you, the page for the reader.

console.log, for you

The console is the developer tools panel, not part of the page. Nothing a visitor sees comes from it, which makes it the right tool while you are working.

JavaScript

JavaScript

const price = 12.5;
const quantity = 3;

console.log('total', price * quantity);
console.log({ price, quantity });

Output

total 37.5
{price: 12.5, quantity: 3}

It takes any number of arguments and shows objects and arrays as structures you can expand, which beats stitching strings together. console.warn and console.error are the same idea with a colour and, for errors, a stack trace.

textContent, for the page

To change what a reader sees, find the element and set its text. Run this one and watch the heading above the console change:

Example

HTML

<h1 id="title">Original</h1>

JavaScript

const heading = document.getElementById('title');

heading.textContent = 'Updated';

Output

The heading reads "Updated".

textContent treats what you give it as text, always. Angle brackets stay angle brackets, and nothing in the string can turn into markup.

innerHTML, and the catch

innerHTML parses the string as HTML, so you can build structure with it:

Example

HTML

<div id="box">empty</div>

JavaScript

const box = document.getElementById('box');

box.innerHTML = '<strong>Saved</strong> just now';

Output

Saved just now, with "Saved" in bold.

Gotcha

Never pass anything a person typed to innerHTML. If a visitor can get their text into that string, they can get a <script> or an onerror handler in with it, and it will run with the full rights of your page: their code can read cookies, act as the logged-in user, and send whatever it finds elsewhere. That is a cross-site scripting hole, and it is the most common serious bug in front-end code.

The rule is simple. Static markup you wrote yourself: innerHTML is fine. Anything from a person, a form, a URL or an API: textContent.

Try it. Change textContent to innerHTML in this example and run it again:

Example

HTML

<p id="out"></p>

JavaScript

// Pretend this came from a form field.
const typed = '<img src=x onerror=console.error(1)>';

document.getElementById('out').textContent = typed;

Output

The markup appears as text, exactly as typed.
With innerHTML it runs instead.

alert, rarely

alert shows a modal box and freezes everything until it is dismissed. It is occasionally useful for a quick check, and almost never right in a finished page.

JavaScript

JavaScript

alert('Saved');

Output

A modal dialog appears. The page stops until it is closed.

confirm and prompt are its siblings, returning a boolean and a string. All three are styled by the browser rather than by you, which is why real interfaces build their own.

document.write, never

You will find document.write in old tutorials. Called after the page has loaded it wipes the entire document and starts a new one, which is almost never what anybody wanted.

JavaScript

JavaScript

// Do not do this.
document.write('Hello');

Output

Before load: inserts text.
After load: erases the whole page first.

There is no situation where it is the best tool. Use textContent or innerHTML on a specific element instead.

Which to use

GoalUse
Check a value while workingconsole.log
Show text to the readertextContent
Insert markup you wroteinnerHTML
Insert anything a person typedtextContent
Interrupt the readeralmost certainly nothing

Test yourself

3 questions

Someone types their name into a form and you want to greet them by it. Which do you use?

Show the answer

textContent Text from a person must never be parsed as markup, or a name containing a script tag becomes running code.

What does console.log put on the page?

Show the answer

Nothing, it writes to the developer console The console is a developer tool. Visitors never see it, which is exactly why it is safe to leave a log in while working.

What happens if document.write runs after the page has loaded?

Show the answer

It replaces the entire document The implicit document.open wipes what was there, which is why the method has no good use left.

Next chapter

Statements

The units a program is made of, and the order they run in.