Translations:DOM-based XSS/27/en

As shown, you can use $1 to create the element, and any attributes that do not include user-controlled data.