sanitizes unescaped HTML to protect you from doing DOM shit like getting XSS'd

charmin.js

function charmin(dirty, whitelist) {
  // returns sanitized HTML; accepts two arguments:
  // (1) dirty: unescaped HTML
  // (2) whitelist: array of allowed HTML tags
  var div = document.createElement('div');
  document.createDocumentFragment().appendChild(div);
  div.innerHTML = dirty;
  var naughty = div.querySelectorAll(whitelist && whitelist.length ? ':not(' + whitelist.join('):not(') + ')' : '*');
  var i = naughty.length;
  while (i--) {
    naughty[i].parentNode.removeChild(naughty[i]);
  }
  return div.innerHTML;
}