Vue · Junior · Question 39 of 75

Why is `v-html` dangerous?

<div v-html="comment.body"></div>

✓Correct answer: It inserts raw HTML without escaping, so user content can execute scripts (XSS)
2It is slower than interpolation
3It only works on the server

Explanation

Vue escapes {{ }} output, but v-html bypasses that. Only use it with trusted content or HTML sanitized by a library such as DOMPurify.

Further reading

Test yourself

Take the Vue · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.