function escapeHTML(str) {
  const div = document.createElement('div');
  div.appendChild(document.createTextNode(str));
  return div.innerHTML;
}

// Usage example:
const userInput = "<script>alert('XSS Attack!');</script>";
const safeOutput = escapeHTML(userInput);
document.getElementById('outputDiv').innerHTML = safeOutput;
// This will display "<script>alert('XSS Attack!');</script>" as text,
// not execute the script.