v151 · DOM · Security
XSS Prevention Guide
Side-by-side comparison of every HTML insertion path: innerHTML (executes scripts), setHTMLUnsafe() (no sanitization), setHTML() with the Sanitizer API (safe), appendHTML() (safe positional), and textContent (text-only escape). Fire XSS payloads at each method and see exactly what gets through.
choose a payload
// XSS alert log — any executed <script> or onerror will appear here
summary table
| Method | Scripts | Event handlers | Decl. Shadow DOM | iframes | Safe for untrusted? |
|---|
implementation reference
Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗