Encoding and trusted content
Text and attribute values are HTML-encoded by default. Cross the raw markup and executable-expression boundaries only with trusted application-controlled values.
On this page
Overview
Text and attribute values are HTML-encoded by default. Cross the raw markup and executable-expression boundaries only with trusted application-controlled values.
Encoded by default
div {
_title "5 < 10"
"<strong>User text</strong>"
}
// <div title="5 < 10"><strong>User text</strong></div>Trusted raw content
Html.raw and Html.js bypass encoding. They do not sanitize HTML or JavaScript and must not receive user-controlled content.
script { Html.js "window.app.start()" }
div { Html.raw trustedSvgMarkup }Trusted names and expressions
Custom element names, custom attribute names, inline event handlers, and Alpine/Datastar expressions are executable or structural code. Encoding their values preserves HTML syntax but does not make untrusted code safe.