Web Security · Junior · Question 22 of 75

What risk does `dangerouslySetInnerHTML` bring in React?

✓Correct answer: It inserts raw HTML, so unsanitized user content can execute scripts
2It only works in development builds
3It makes the component re-render on every keystroke

Explanation

The long name is a warning. If the HTML comes from users or third parties, sanitize it first, for example with DOMPurify.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.