demo · v152
Sanitizer Comparison
Same payload through three pipelines side-by-side: setHTML() (sanitised), setHTMLUnsafe() (verbatim, with declarative shadow DOM), and legacy innerHTML. See what each one strips, keeps, and runs.
Live payload runner. The "unsafe" variants execute scripts and event handlers. Only paste payloads you'd trust on your own origin. Keep the legacy
innerHTML column as the baseline most apps use today.
preset payload
payload
compare
setHTML() — sanitised
element.setHTML(payload) — default sanitiser drops unsafe markup
setHTMLUnsafe() — verbatim
element.setHTMLUnsafe(payload) — parses everything, including DSD
innerHTML — legacy baseline
element.innerHTML = payload — parses but doesn't run inline script
verdict
—