From f83a55d87859b4ef27802bc08adf943d99d03e04 Mon Sep 17 00:00:00 2001 From: Lode Claassen Date: Thu, 2 May 2019 21:49:42 +0200 Subject: [PATCH] clarify when sanitization is done and when not --- site/content/tutorial/01-introduction/06-html-tags/text.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/tutorial/01-introduction/06-html-tags/text.md b/site/content/tutorial/01-introduction/06-html-tags/text.md index fdc8a576ff..cf5032fea4 100644 --- a/site/content/tutorial/01-introduction/06-html-tags/text.md +++ b/site/content/tutorial/01-introduction/06-html-tags/text.md @@ -12,4 +12,4 @@ In Svelte, you do this with the special `{@html ...}` tag:

{@html string}

``` -> Svelte doesn't perform any sanitization of the data before it gets inserted into the DOM. In other words, it's critical that you manually escape HTML that comes from sources you don't trust, otherwise you risk exposing your users to XSS attacks. \ No newline at end of file +> Svelte doesn't perform any sanitization of the data before it gets inserted into the DOM via a @html-tag. In other words, if you use `{@html ...}` it's critical that you manually escape HTML that comes from sources you don't trust, otherwise you risk exposing your users to XSS attacks.