Fix innerHTML used for untrusted text — find the bug

const fromUser = "<img src=x alt=bad>";
document.getElementById("box").innerHTML = fromUser;
document.querySelector('#out').textContent = document.querySelectorAll("img").length > 0 ? "an image was made" : "no image made";