Daily security quiz #4

Question for 2026-11-04. Read the code and pick the most serious security vulnerability.

This code displays a search term on the page. What is the most serious vulnerability?

1const params = new URLSearchParams(location.search);
2const q = params.get('q') ?? '';
3 
4document.querySelector('#result-title').innerHTML =
5  '<b>' + q + '</b> search results';

1. AURLSearchParams does not work in older browsers
2. BAn error occurs if the search term is empty
3. CThe querySelector result may be null
4. DInserting the URL's q value using innerHTML can execute scripts (XSS)