Do I need to do string sanitization before adding to the DOM?
In our team, we came up with the idea that before adding to the DOM, we need to sanitize the strings. We expected at least double quotes to be annoying when used in setAttribute and <and> when added to node content.
The first tests showed something different. We use innerHTML to set the content of the nodes. It eludes all unsafe characters. But even setAttribute escapes <and>
So is this always the case because I couldn't find anything on Google? I don't know if there are browsers out there that will fail.
a source to share
innerHTML edits the HTML inside the element and creates DOM nodes from it - you need to write HTML according to normal rules (for example, you cannot use the <character, unless it is followed by an unnamed character). However, browsers will do a normal restore.
I don't understand why your innerHTML experience is different from this.
createTextNode, setAttribute, etc. edit the DOM directly. HTML is not involved, so you don't have to deal with characters that have special meaning in HTML.
a source to share