Element.setAttribute() is an instance method that sets or updates an HTML attribute by name. Learn the MDN name and disabled examples, boolean attributes, data-* and aria-* patterns, XSS injection-sink warnings, and five try-it labs aligned with MDN.
01
Kind
Instance method
02
Args
name, value
03
Returns
undefined
04
Boolean
"" or name
05
Security
XSS sinks
06
Status
Baseline widely
Fundamentals
Introduction
HTML elements carry attributes—id, class, href, disabled, data-action, and many more. To add or change an attribute from JavaScript, call element.setAttribute(qualifiedName, value). MDN: if the attribute already exists, the value is updated; otherwise a new attribute is added.
On HTML elements in an HTML document, the attribute name is automatically lower-cased when you call setAttribute() (MDN). Non-string values are converted to strings.
💡
Security note (MDN)
Some attributes are injection sinks—values may be parsed as HTML or run as script (e.g. onclick, srcdoc, src on scripts). Never pass untrusted user input to those attributes. Use safe alternatives like addEventListener or sanitized TrustedHTML when Trusted Types are enforced.
Element.setAttribute() is Baseline Widely available (MDN: across browsers since July 2015). Logos use the shared browser-image-sprite.png sprite from this project.
✓ Baseline Widely available
Element.setAttribute()
Set or update any HTML attribute by name — the standard DOM API for dynamic markup.
BaselineWidely available
Google ChromeSupported · Desktop & Mobile
Yes
Microsoft EdgeSupported · Chromium
Yes
Mozilla FirefoxSupported · Desktop & Mobile
Yes
Apple SafariSupported · macOS & iOS
Yes
OperaSupported · Modern versions
Yes
Internet ExplorerSupported in legacy IE
Yes
setAttribute()Excellent
Bottom line: Use setAttribute() for generic attribute writes, IDL properties for common reflected fields, and removeAttribute() to delete. Avoid injection sinks with untrusted input.
Wrap Up
Conclusion
Element.setAttribute() adds or updates HTML attributes by name. It is Baseline widely available, returns undefined, and pairs naturally with getAttribute() and removeAttribute().
Set boolean attrs with "" or the attribute name (MDN)
Sanitize or avoid user input on injection-sink attributes
Use addEventListener instead of onclick strings
Verify with getAttribute() after setting
❌ Don’t
Pass untrusted strings to onclick or srcdoc
Use setAttribute(name, null) to delete attributes
Expect a useful return value (it is undefined)
Rely on uppercase attribute names in HTML documents
Confuse attributes with textContent / innerHTML
Summary
Key Takeaways
Knowledge Unlocked
Five things to remember about Element.setAttribute()
Set any attribute — add or update.
5
Core concepts
📝01
Returns
undefined
API
📄02
Args
name, value
Pair
✍️03
Boolean
"" or name
Toggle
✅04
Baseline
widely available
Status
⚡05
Security
XSS sinks
Caution
❓ Frequently Asked Questions
It sets the value of an attribute on the element. If the attribute already exists, the value is updated; otherwise a new attribute is added (MDN).
No. MDN marks Element.setAttribute() as Baseline Widely available (across browsers since July 2015). It is not Deprecated, Experimental, or Non-standard.
undefined. There is no return value (MDN).
Set value to "" or "disabled". Presence means true; call removeAttribute() to turn it off (MDN).
No. IDL properties reflect specific attributes and may coerce types. setAttribute() sets any attribute by name as a string.
Some attributes (onclick, srcdoc, script src) are XSS injection sinks. Never pass untrusted strings to those. Prefer safe attributes like aria-label or sanitized data-* values.
Did you know?
On HTML elements in an HTML document, setAttribute("ID", "x") and setAttribute("id", "x") are equivalent—the browser lower-cases the attribute name before storing it.