Browser & Web Performance · Junior · Question 61 of 75

Why don't React and Vue templates usually cause XSS when you render `{userInput}`?

✓Correct answer: They escape values inserted as text by default
2They run all scripts in a sandbox
3They block user input that contains <

Explanation

Escaping is the default; risk returns with escape hatches like dangerouslySetInnerHTML or v-html, and with javascript: URLs.

Further reading

Test yourself

Take the Browser & Web Performance · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.