Vue · Senior · Question 27 of 75

Why is mounting Vue on server-rendered HTML that contains user content dangerous?

✓Correct answer: With the full build, Vue compiles the in-DOM HTML as a template, so {{ }} in user content becomes executable template injection
2It causes hydration mismatches only
3Vue refuses to mount on such HTML

Explanation

Never let user content become part of a template. Escape it on the server or use precompiled SFCs, where user data is only ever bound as data.

Further reading

Vue: Security ↗

Test yourself

Take the Vue · Senior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.