3 ms·
innerHtml wouldn't eliminate xss vectors though, things like load=something could bypass this.
by foota 9y ago
innerHtml wouldn't eliminate xss vectors though, things like load=something could bypass this.
- inimino 9y agoYes, it's not completely safe. In a beginner tutorial, if you allow arbitrary HTML you should state that it shouldn't be done that way in a real app.