Skip to content

Commit 0ebc566

Browse files
docs: enhane @html tag warning (sveltejs#415)
1 parent ac479f4 commit 0ebc566

File tree

1 file changed

+1
-1
lines changed
  • content/tutorial/01-svelte/01-introduction/06-html-tags

1 file changed

+1
-1
lines changed

content/tutorial/01-svelte/01-introduction/06-html-tags/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,4 +13,4 @@ In Svelte, you do this with the special `{@html ...}` tag:
1313
<p>{+++@html+++ string}</p>
1414
```
1515

16-
> **Warning!** Svelte doesn't perform any sanitization of the expression inside `{@html ...}` before it gets inserted into the DOM. In other words, if you use this feature it's critical that you manually escape HTML that comes from sources you don't trust, otherwise you risk exposing your users to <a href="https://owasp.org/www-community/attacks/xss/" target="_blank">Cross-Site Scripting</a> (XSS) attacks.
16+
> **Warning!** Svelte doesn't perform any sanitization of the expression inside `{@html ...}` before it gets inserted into the DOM. This isn't an issue if the content is something you trust like an article you wrote youself. However if it's some untrusted user content, e.g. a comment on an article, then it's critical that you manually escape it, otherwise you risk exposing your users to <a href="https://owasp.org/www-community/attacks/xss/" target="_blank">Cross-Site Scripting</a> (XSS) attacks.

0 commit comments

Comments
 (0)