Fix

Such a simple site like this doesn't need jQuery at all. Without jQuery, we reduce the attack surface of our web page.

HTML5 security policy actually prevents interpretation of scripts that are injected with innerHTML. Nevertheless, it would be safer to use innerText instead.

document.getElementById('note').innerText = note;