svelte/test/runtime/samples/inline-style-directive-escape/main.svelte

<script>
  export let attack = '" onload="alert(\'uhoh\')" data-nothing="not important';
</script>

<div style:--css-variable={attack} />