Your new job was impressed that you had some exposure to CIS…

Your new job was impressed that you had some exposure to CIS/STIG/OWASP frameworks.  Your new boss asks what the security cheat sheets recommend on their project which uses AJAX for their client-side JavaScript, with regard to the use of .innertext, .innerHTML, and eval() within their code.