JSFiddle - React, Tailwind, and code Playground

by mikecmpbll

JavaScript

/* init */
let fromJSON = { evil: '"><img src=x:alert(alt) onerror=eval(src) alt=xss>' }

/* bad */
let bad = "<h1 style='color: red;'>" + fromJSON.evil + "</h1><p>hacked.</p>"

/* good */
let evil = document.createElement('span')
evil.innerText = fromJSON.evil
let good = "<h1 style='color: green;'>" + evil.innerHTML + "</h1><p>not hacked.</p>"

/* run */
document.body.innerHTML = good