How to create an HTML editor in JavaScript?

Question

JavaScript

Hello. A question.
If you create your own online html editor, then if the user writes something like this in it:
<h1>Hello, World!</h1>
Then you need to markup, that is, show the text as h1.
but the problem is that if the user writes the following:
<script>alert('xss')</script>
Then this code will naturally execute, which is not good.
As an option: this is replace to look for the script tag and replace its brackets with entities or escape them.
But is this option correct? perhaps there are options or your suggestions are much better than this?
Thanks for your help and your time.

Answer 1

And if the user writes the same command in the console and it is executed in his browser? Horror-horror!

Answer 2

<script>alert('xss')</script>
So this is what an xss attack on a site looks like! Thanks, now I know.