HTML Code

<!DOCTYPE html>
<html lang="en">
<head>
  <meta charset="utf-8">
  <title>Lodash escape - safe interpolate (Try It)</title>
</head>
<body>
  <h1>Safe interpolate tag</h1>
  <pre id="out"></pre>
  <script src="https://cdn.jsdelivr.net/npm/lodash@4.17.21/lodash.min.js"></script>
  <script>
    (function () {
      var malicious = "<img src=x onerror=alert(1)>";
      var tag = "<" + "%= obj.comment %" + ">";
      var src = "<div>" + tag + "</div>";
      var render = _.template(src);
      document.getElementById("out").textContent = render({ comment: malicious });
    })();
  </script>
</body>
</html>

Lines: 0 | Characters: 0

Live Preview Auto-refresh on Run

Lodash _.templateSettings.escape - safe interpolate (Try It)