logoalt Hacker News

Aachen • yesterday at 3:20 PM • 2 replies • view on HN

The traditional way: separating data and code

    document.createElement("h1").textContent = `Hello, ${username}!`
If you allow <h1> in the setHTML configuration or use the default, users with the tag in their username also always get it rendered as markup

Replies

itishappy • yesterday at 3:43 PM

It sounds like you're arguing against a specific usecase, rather than the technology itself. If you don't want arbitrary markup in usernames, setHTML would absolutely be the wrong choice, but that's not really a good argument against setHTML.

matsemann • yesterday at 3:27 PM

Which is why you only use it where you want to allow some kind of html..?