From 4acfb053157caa063cb6405673e03e0c513e8eac Mon Sep 17 00:00:00 2001 From: Simon H <5968653+dummdidumm@users.noreply.github.com> Date: Sat, 29 May 2021 18:44:42 +0200 Subject: [PATCH] Docs: Clarify that `@html` does not compile Svelte code (#6349) --- site/content/docs/02-template-syntax.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/site/content/docs/02-template-syntax.md b/site/content/docs/02-template-syntax.md index 85b6ef553e..2ff5b1362c 100644 --- a/site/content/docs/02-template-syntax.md +++ b/site/content/docs/02-template-syntax.md @@ -393,7 +393,7 @@ When used around components, this will cause them to be reinstantiated and reini In a text expression, characters like `<` and `>` are escaped; however, with HTML expressions, they're not. -The expression should be valid standalone HTML — `{@html "
"}content{@html "
"}` will *not* work, because `` is not valid HTML. +The expression should be valid standalone HTML — `{@html "
"}content{@html "
"}` will *not* work, because `` is not valid HTML. It also will *not* compile Svelte code. > Svelte does not sanitize expressions before injecting HTML. If the data comes from an untrusted source, you must sanitize it, or you are exposing your users to an XSS vulnerability.