HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>html vs text safety</title>
  <style>
    body { font-family: sans-serif; padding: 16px; max-width: 560px; }
    .box { border: 1px solid #cbd5e1; padding: 10px; margin: 8px 0; border-radius: 6px; min-height: 24px; }
    #unsafe { background: #fee2e2; }
    #safe { background: #dcfce7; }
    h4 { margin: 12px 0 4px; font-size: 13px; color: #64748b; }
    button { margin-top: 12px; padding: 10px 16px; background: #6366f1; color: #fff; border: none; border-radius: 6px; cursor: pointer; }
    #hint { color: #64748b; font-size: 14px; margin-top: 10px; }
  </style>
</head>
<body>
  <h4>#unsafe — .html(userInput)</h4>
  <div id="unsafe" class="box"></div>
  <h4>#safe — .text(userInput)</h4>
  <div id="safe" class="box"></div>
  <button type="button">Insert sample malicious string</button>
  <p id="hint">Demo uses harmless markup — real XSS would execute scripts.</p>
  <script src="https://code.jquery.com/jquery-3.7.1.min.js"></script>
  <script>
    $("button").on("click", function() {
      var userInput = "<img src=x onerror="this.parentNode.innerHTML='XSS parsed as HTML'">";
      $("#unsafe").html(userInput);
      $("#safe").text(userInput);
      $("#hint").text("#unsafe parsed HTML; #safe shows literal angle brackets.");
    });
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

jQuery .html() vs .text() — XSS safety (Try It)