4 ms·
React (technically JSX) has a nice feature where all output is escaped. So this doesn't work: const evil = "<script>alert('')</script>"; .. <div>{evil}</
by colejohnson66 5y ago
React (technically JSX) has a nice feature where all output is escaped. So this doesn't work:
const evil = "<script>alert('')</script>";
..
<div>{evil}</div>
That'll output:
<div><script>alert('')</script></div>
If you must output a raw HTML string, they make you acknowledge that you're aware of what you're doing:
<div dangerouslySetInnerHTML={{__html: evil}} />