How do you prevent XSS (cross-site scripting) when using jQuery?

<div id="out"></div>

var userInput = '<img src=x onerror=alert(1)>';
$('#out').text(userInput);
console.log($('#out').html());
console.log($('#out').find('img').length);

• Use .text() or .val() for user data. .html(), .append(string) and $(string) read HTML.
• Create elements with $('<li>').text(data).
• Validate and escape on the server, and use a Content Security Policy.

• Previous Interview Question
• Next Interview Question

---

Tutorials
No Content Found.

Exercises & Assignments
No Content Found.

Interview Questions & Answers
No Content Found.