v148 · in developer trial

Sanitizer Integration Demo

Drive the renewed HTML insertion methods with the same payload and sanitizer options. The safe methods call setHTML(html, options) and appendHTML(html, options); the unsafe path calls setHTMLUnsafe(html, options) so you can see when sanitization is explicitly passed and when runScripts is only available to unsafe insertion.

Checking native support for the Chrome 148 HTML insertion methods.
Element.setHTMLchecking
Element.appendHTMLchecking
Element.setHTMLUnsafechecking
Sanitizerchecking
Payload, sanitizer, and unsafe options
Unsafe options 

    

  


  

    

      

        setHTML(html, options)
        waiting
      

      

        
Rendered result

        

        

        
Serialized DOM

        
Run the demo to inspect the sanitized DOM.

      

    


    

      

        appendHTML(html, options)
        waiting
      

      

        
Rendered result

        

        

        
Serialized DOM

        
Run the demo to inspect the appended DOM.

      

    


    

      

        setHTMLUnsafe(html, options)
        waiting
      

      

        
Rendered result

        

        

        
Serialized DOM

        
Run the demo to inspect the unsafe DOM.

      

    


    

      

        innerHTML legacy baseline
        waiting
      

      

        
Rendered result

        

        

        
Serialized DOM

        
Run the demo to compare legacy insertion.

      

    

  


  

    

      Spec behavior checklist
    

    

      

        
          

            Behavior
            Safe methods
            Unsafe methods
            Legacy innerHTML
          

        
        
          

            Sanitizer option
            Required by this demo: { sanitizer }
            Optional: unchecked means unrestricted default
            No platform sanitizer hook
          

          

            Baseline XSS removal
            Safe variants apply baseline protection
            No implicit baseline; result depends on the sanitizer passed
            Scripts are inert, but attributes and URLs remain
          

          

            Insertion point
            setHTML() replaces; appendHTML() appends
            setHTMLUnsafe() replaces the target contents
            Setter replaces the target contents
          

          

            runScripts
            Not available on safe dynamic markup injection
            Available through SetHTMLUnsafeOptions
            No equivalent option
          

        
      

    

  


  

    

      References
    

    

      
    

  


  

    
implementation reference

    
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗