Web Security · Junior · Question 21 of 75

Why is rendering `{comment.text}` in JSX safe from XSS by default?

1React removes every string that contains <
✓Correct answer: React escapes string values before inserting them, so tags become plain text
3JSX runs only on the server, never in the browser

Explanation

React sets text through the DOM as text nodes. Markup in the string is shown literally instead of being parsed.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.