Regular html against injections

  <div id="hello">
  <script>
  const inp = "<img src='x' onerror ='alert(\"whoops, hacked!\")'>"
  document.getElementById("hello").innerHTML =  inp;
  </script>
  </div>

This executes the code, and pops up an alert.

const inp = "<img src='x' onerror='alert(\"whoops, hacked\")'>";
return <div>{inp}</div>;

This only renders the text, unlike regular js.