From 078338a60e1210bdc2cc3f2db374c95bed5e32c4 Mon Sep 17 00:00:00 2001 From: Rich Harris Date: Fri, 3 May 2019 23:24:00 -0400 Subject: [PATCH] Update text.md --- site/content/tutorial/01-introduction/06-html-tags/text.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/tutorial/01-introduction/06-html-tags/text.md b/site/content/tutorial/01-introduction/06-html-tags/text.md index cf5032fea4..ff547247e2 100644 --- a/site/content/tutorial/01-introduction/06-html-tags/text.md +++ b/site/content/tutorial/01-introduction/06-html-tags/text.md @@ -12,4 +12,4 @@ In Svelte, you do this with the special `{@html ...}` tag:

{@html string}

``` -> Svelte doesn't perform any sanitization of the data before it gets inserted into the DOM via a @html-tag. In other words, if you use `{@html ...}` it's critical that you manually escape HTML that comes from sources you don't trust, otherwise you risk exposing your users to XSS attacks. +> Svelte doesn't perform any sanitization of the expression inside `{@html ...}` before it gets inserted into the DOM. In other words, if you use this feature it's critical that you manually escape HTML that comes from sources you don't trust, otherwise you risk exposing your users to XSS attacks.