I\'m outputting values from a database (it isn\'t really open to public entry, but it is open to entry by a user at the company -- meaning, I\'m not worried about XSS).
This is how I do it, basically str.replace(/[\""]/g, '\\"').
str.replace(/[\""]/g, '\\"')
var display = document.getElementById('output'); var str = 'class="whatever-foo__input" id="node-key"'; display.innerHTML = str.replace(/[\""]/g, '\\"'); //will return class=\"whatever-foo__input\" id=\"node-key\"