Why doesn't xss work?

Question

JavaScript

I wrote two versions of the same code. The bottom line is that the user enters malicious code into the input field: As a result, the jquery code executes the alert command. And the nativeJS code does not execute. LIVE DEMO Please help me to make the nativeJS code also execute the alert command. It is not necessary to use innerHTML. I tried using createElement/createTextNode instead of innerHTML , but that didn't work either. Although the jquery method uses them, judging by the sources
<script>alert('xss attack')</script>

Answer 1

Script elements inserted using innerHTML do not execute when they are inserted.

The
Xs standard, how jQuery does it all inside, but apparently they process it in their own way. You can still use XSS, just not as explicitly.
For example, this will work<img src='x' onerror='alert(1)'>