Search for a command to run...
I'm a solutions engineer lead, GitHub Star, Director of WomenDevsSG, and co founder of ragTech. I work at the intersection of tech, systems, and leadership, and this blog is where I share my journey through all three. Expect honest reflections, real experiences, and thoughts that are still forming rather than polished career advice.
What an article and what timing!! Super dooper thanks for sharing this.. I've been wondering how to set innerHTML in React for a while. Gonna put this to practice in my project. I'm gonna use it to set the alert messages with the proper inner styling and hence this is useful for me. Thanks once again for this great article Victoria! You rock✨
Wow thanks! Didn't know my timing was this good! Glad you find it helpful :)
Let's be honest. We all started from level 0. There's no shame in that. Here's the series for the newbies~ Hope you can learn and feel free to ask a lot of questions! Check my other series: Random project to build
In web development practice, it is common for web apps to separate their front-end from back-end services. As such, accessing resources from the back-end requires the understanding of Cross-Origin Resource Sharing or CORS for short. It is an essentia...
How to Install Skills + Installing gog skill + Setup workflows
Part 1 - Intro to OpenClaw + Setting up on Oracle Cloud Free Tier + Connect to Telegram
And what The Human Condition taught me about slowing down
Beyond the ethics and environmentalism, Karen Hao’s exposé reveals the chillingly brilliant, multi-move strategy of AI’s quintessential architect.
How the system really works, what most people miss, and how to make opportunities find you
Hello everyone! In this article, I shall explain what dangerouslySetInnerHTML is in React and how to use it safely. Let's begin!
The React framework is known to have adopted a browser-independent DOM system, which means it does not interact with the DOM directly. And so in React, you will notice that you are not allowed to add HTML strings directly. For example:
let someHTMLString = "<p>Hello</p>";
export default function App() {
return(
<div>{someHTMLString}</div>
);
}
The output would literally be the string <p>Hello</p> instead of a "Hello" inside a paragraph element.
Instead, we can use dangerouslySetInnerHTML, which is React's version of innerHTML. It is used as a prop where you can pass an object with a __html key like so:
dangerouslySetInnerHTML={{__html: getMarkup()}}
The value of the __html key can be a string which will be injected as HTML code directly from React. This is how React can directly add HTML code to the DOM.
As you may have noticed, the name of this prop is particularly frightening for a reason. It is not safe to simply add your HTML code as this is prone to Cross Site Scripting or XSS attacks for short.
XSS attack is a type of security vulnerability where attackers inject code client-side to steal information and perform malicious scripts in the app. Let's illustrate this with an example.
You can read more about other security threats in this article.
Let's say we have a text editing app like below:
The user is allowed to write anything on the text editor and style it however they want. Then, when the Save button is clicked, the text editor would render the user's input on the HTML page like so:
Behind the scenes, the text editor basically returns the value: <h3>Hello!</h3><p>I am a text!</p>, where **value **is the user's input with HTML tags added by the editor. In order to render value to the page, we use:
<div dangerouslySetInnerHTML={{ __html: value }}/>
But what if a malicious user types some code enclosed in <script> tags?
value would be:
<p><script>alert('This is some malicious script! >:)')</script></p>
which means the malicious script injected would be executed and can be used to steal the user's cookies, personal data and other sensitive information.
DOMPurify is an npm package written by over 60 web security professionals to sanitize HTML code, preventing XSS attacks.
With DOMPurify, we can increase the security of our injected HTML code from dangerouslySetInnerHTML. Let's see how we can safely use our text editor in the example earlier.
Install the package by running the code in your project's root folder.
npm install dompurify
In the .js file where you will use dangerouslySetInnerHTML, add the import statement at the top.
import DOMPurify from "dompurify";
Then, we simply pass our value into the .sanitize() method.
<div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(value) }}/>
And instead of executing the script, the code will be safely removed from the HTML page. So nothing will render or execute.
While sometimes it is inevitable that we may need to use dangerouslySetInnerHTML in our projects, it is crucial to understand the dangerous and security implications that this prop has.
Thanks for reading! As always, please feel free to share your thoughts in the comments below. I hope it has been a useful read. Also, please check out some extra reading in the section below if you want to know more about the things we've discussed today. Till next time, cheers!