Add DOM Content

DOM-Content.md

@@ -0,0 +1,90 @@
+* [`html`](#usage-html) | [`text`](#usage-text) | [`load`](#usage-load)
+
+---
+
+## <a id="usage-html"></a>.html
+
+**Description**
+Gets the HTML contents of the first element in the set, or sets the HTML contents of every matched element. 
+
+🛡️ **Security by Default:** When setting HTML, jBase automatically strips dangerous inline event handlers (like `onerror`) and malicious protocols (like `href="javascript:..."`) to mitigate XSS attacks. Embedded `<script>` tags are placed into the DOM but are **not** executed by the browser.
+
+⚙️ **Executing Scripts:** If you are injecting trusted content that contains `<script>` tags which *must* be executed, you can pass the `executeScripts: true` flag.
+
+**Parameters**
+
+* `content` (String, optional): The HTML string to set. If omitted, the method acts as a getter.
+* `options` (Object, optional): Configuration options for the injection.
+  * `executeScripts` (Boolean): If `true`, jBase will extract, execute, and evaluate any `<script>` tags found in the injected HTML string. Default is `false`.
+
+**Returns**
+
+* (String): The inner HTML of the first matched element (if used as a getter).
+* (jBase): The current instance for chaining (if used as a setter).
+
+**Examples**
+```javascript
+// 1. GETTER: Retrieve HTML
+const content = $('#container').html();
+
+// 2. SETTER (Safe Default): Inject HTML (strips inline events, scripts are ignored)
+$('#container').html('<div class="child">Hello</div>');
+
+// 3. SETTER (Trusted Execution): Inject HTML and execute embedded scripts
+$('#widget').html('<script>initWidget();</script>', { executeScripts: true });
+```
+
+---
+
+## <a id="usage-text"></a>.text
+
+**Description**
+Get the combined text contents of each element in the set of matched elements, including their descendants, or set the text contents of the matched elements.
+
+**Parameters**
+
+* `content` (String, optional): The text to set.
+
+**Returns**
+
+* (String): Text content (if getter).
+* (jBase): Current instance (if setter).
+
+**Example**
+
+```javascript
+$('h1').text('Welcome to jBase');
+
+```
+
+---
+
+## <a id="usage-load"></a>.load
+
+**Description**
+Loads HTML content from a server and automatically injects it into the matched elements. This is an asynchronous wrapper utilizing `$.http.getText()`.
+
+🛡️ **Security by Default:** When setting HTML, jBase automatically strips dangerous inline event handlers (like `onerror`) and malicious protocols (like `href="javascript:..."`) to mitigate XSS attacks. Embedded `<script>` tags are placed into the DOM but are **not** executed by the browser.
+
+⚙️ **Executing Scripts:** If you are loading trusted content that contains `<script>` tags which *must* be executed upon loading, you can pass the `executeScripts: true` flag.
+
+**Parameters**
+
+* `url` (String): The URL to fetch the HTML from.
+* `options` (Object, optional): Standard `RequestInit` fetch options, extended with jBase specific flags.
+  * `executeScripts` (Boolean): If `true`, jBase will extract, execute, and evaluate any `<script>` tags found in the loaded HTML. Default is `false`.
+
+**Returns**
+
+* (Promise<jBase>): A promise that resolves to the current jBase instance.
+
+**Example**
+```javascript
+// Default: Safe load (no scripts executed, inline events stripped)
+await $('#sidebar').load('/partials/sidebar.html');
+
+// Trusted load: Execute scripts found in the fetched HTML
+await $('#widget-container').load('/partials/interactive-widget.html', { 
+    executeScripts: true 
+});
+```