Is this JS script vulnerable to XSS?

Okay so i have a JS function that take my server response that would be multiple html Elements.

I add all of those elements with innerHTML and i know it can cause XSS attack but i struggle to understand how XSS work but i have a vague idea on how it work. I was just wondering if in this configuration it could cause XSS?

Also on the server side everything is sanitized to prevent any html user input.

JS Code :

function searchCharacter(search_param){ let main_screen = document.getElementById("main_screen"); while(main_screen.firstChild){ main_screen.removeChild(main_screen.firstChild); } var xhttp = new XMLHttpRequest(); xhttp.onreadystatechange = function() { if (this.readyState == 4 && this.status == 200) { main_screen.innerHTML = this.response } }; let url = ("Menu.php?search="+search_param); xhttp.open("POST", url, true); xhttp.send(); }

Php code :

if(isset($_REQUEST["search"])) { $search_parameter = $_REQUEST["search"]; get_characters($account_id, $search_parameter, $expiration_date, $dbh); exit(); }

Edit : here is my function to get characters(i know it's messy it is just an exemple)

function get_characters($account_id, $search, $expiration_date, $dbh) { $sanitized_search = htmlspecialchars($search, ENT_QUOTES, "UTF-8"); if(!check_token_expiration_date($expiration_date, $dbh)) { $get_characters = $dbh->prepare("SELECT * FROM `personnage` WHERE `id_utilisateur` = '$account_id' AND `nom` LIKE '%$sanitized_search%'"); $get_characters->execute(); $characters_value = $get_characters->fetchALL(PDO::FETCH_ASSOC); foreach($characters_value as $character) { $character_ispublic_asnumber = $character["partage"]; $character_ispublic_bool = false; $character_name = $character["nom"]; $character_id = $character["id_personnage"]; if($character["partage"] == 1) {$character_ispublic = "checked"; $character_ispublic_bool = true;} else{ $character_ispublic = "nempta"; $character_ispublic_bool = false;} echo(" <form class='character_sheet' action='Menu.php?link=mycharacter' method='POST'> <div> <h2><a> $character_name </a></h2> </div> <span class='overlay'> <span> <a href='CharacterPage.php?character=$character_id' class='button'>Modifier</a> <a href='CharacterPage.php?character=$character_id&link=delete' class='delete'>Suprimer</a> <input type='checkbox' name='tag_1' id='tag_$character_id' onclick='loadDoc($character_id);' value='$character_ispublic_bool' $character_ispublic /> <label for='tag_1'>Partager</label> <input type='hidden' name='character_id' value='$character_id' /> </span> </span> </form> "); } } else { echo"<H1>Veuiller vous connecter pour accéder a vos personnages</H1>"; }