React · Junior · Question 38 of 75
What's dangerous about dangerouslySetInnerHTML?
- 1It slows rendering dozens of times due to parsing
- ✓Correct answer: It inserts HTML without escaping - an XSS risk
- 3It works only in React class components
Explanation
React normally escapes strings, so {userInput} is safe. dangerouslySetInnerHTML={{ __html }} inserts markup as is, and <img onerror=...> from user data runs a script. If you really need HTML (e.g. from a CMS), clean it with a sanitizer (DOMPurify).