HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>mXSS safe pattern</title>
  <style>body{font-family:sans-serif;margin:1rem;} .box{padding:0.5rem;margin:0.5rem 0;border:1px solid #cbd5e1;border-radius:6px;}</style>
</head>
<body>
  <div id="a" class="box">A</div>
  <div id="b" class="box">B</div>
  <pre id="out"></pre>
  <script>
    var unsafe = '<p>Hello</p><script>alert(1)<\/script>';
    var a = document.getElementById("a");
    var b = document.getElementById("b");
    if (typeof a.setHTML === "function") {
      a.setHTML(unsafe);
      var serialized = a.innerHTML;
      b.setHTML(serialized);
      document.getElementById("out").textContent = "b: " + b.innerHTML;
    } else {
      document.getElementById("out").textContent = "setHTML not supported";
    }
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

Element.setHTML — safe re-inject (Try It)