javascript / beginner
Snippet
Preventing XSS Attacks with Safe Default Text Interpolation
By default, Svelte automatically escapes HTML entities inside standard curly-brace expressions, protecting your application against Cross-Site Scripting (XSS) attacks from untrusted input.
snippet.js
javascript
1
2
3
4
5
6
<script>let userInput = '<script>alert("XSS")<\/script><b>Hello</b>';</script><!-- Safe: Text interpolation auto-escapes HTML entities --><div>{userInput}</div>
svelte
Breakdown
1
let userInput = '<script>alert("XSS")<\/script><b>Hello</b>';
Stores an untrusted string containing potential HTML and script injection.
2
<div>{userInput}</div>
Safely renders the content as plain text, rendering tags harmlessly as visible text instead of executable HTML.