top | item 47138095

(no title)

Aachen | 5 days ago

Injecting markup into someone else's website isn't what I'd call too strict a default configuration

If you mean to convey that it's possible to configure it to filter properly, let me introduce you to `textContent` which is older than Firefox (I'm struggling to find a date it's so old)

discuss

order

itishappy|5 days ago

That's the whole point of the setHTML.

How would I set a header level using textContent?

Aachen|5 days ago

The traditional way: separating data and code

    document.createElement("h1").textContent = `Hello, ${username}!`
If you allow <h1> in the setHTML configuration or use the default, users with the tag in their username also always get it rendered as markup