Skip to main content

Encoding and trusted content

Text and attribute values are HTML-encoded by default. Cross the raw markup and executable-expression boundaries only with trusted application-controlled values.

On this page

Overview

Text and attribute values are HTML-encoded by default. Cross the raw markup and executable-expression boundaries only with trusted application-controlled values.

Encoded by default

div {
    _title "5 < 10"
    "<strong>User text</strong>"
}
// <div title="5 &lt; 10">&lt;strong&gt;User text&lt;/strong&gt;</div>

Trusted raw content

Html.raw and Html.js bypass encoding. They do not sanitize HTML or JavaScript and must not receive user-controlled content.

script { Html.js "window.app.start()" }
div { Html.raw trustedSvgMarkup }

Trusted names and expressions

Custom element names, custom attribute names, inline event handlers, and Alpine/Datastar expressions are executable or structural code. Encoding their values preserves HTML syntax but does not make untrusted code safe.