---
title: "Injection and cross-site scripting · vuejs.school"
description: "Keep visitors' text from running as code or as a query, with Vue's escaping, sanitised HTML that also works during server rendering, allow-listed URLs and parameterised queries."
canonical_url: "https://vuejs.school/learn/security/injection-and-cross-site-scripting"
meta:
  "og:description": "Keep visitors' text from running as code or as a query, with Vue's escaping, sanitised HTML that also works during server rendering, allow-listed URLs and parameterised queries."
  "og:image": "https://vuejs.school/_og/d/a_~SW5qZWN0aW9uIGFuZCBjcm9zcy1zaXRlIHNjcmlwdGluZyDCtyB2dWVqcy5zY2hvb2w%2Cc_OgCard.takumi%2Ctitle_Injection%2Band%2Bcross-site%2Bscripting%2Cdescription_~S2VlcCB2aXNpdG9ycycgdGV4dCBmcm9tIHJ1bm5pbmcgYXMgY29kZSBvciBhcyBhIHF1ZXJ5LCB3aXRoIFZ1ZSdzIGVzY2FwaW5nLCBzYW5pdGlzZWQgSFRNTCB0aGF0IGFsc28gd29ya3MgZHVyaW5nIHNlcnZlciByZW5kZXJpbmcsIGFsbG93LWxpc3RlZCBVUkxzIGFuZCBwYXJhbWV0ZXJpc2VkIHF1ZXJpZXMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNCBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9pbmplY3Rpb24tYW5kLWNyb3NzLXNpdGUtc2NyaXB0aW5nIg%2Cs_lhSuv9baKXo910JT.png"
  "og:image:alt": "Injection and cross-site scripting · vuejs.school"
  "og:image:height": "600"
  "og:image:type": image/png
  "og:image:width": "1200"
  "og:title": "Injection and cross-site scripting · vuejs.school"
  "twitter:image": "https://vuejs.school/_og/d/a_~SW5qZWN0aW9uIGFuZCBjcm9zcy1zaXRlIHNjcmlwdGluZyDCtyB2dWVqcy5zY2hvb2w%2Cc_OgCard.takumi%2Ctitle_Injection%2Band%2Bcross-site%2Bscripting%2Cdescription_~S2VlcCB2aXNpdG9ycycgdGV4dCBmcm9tIHJ1bm5pbmcgYXMgY29kZSBvciBhcyBhIHF1ZXJ5LCB3aXRoIFZ1ZSdzIGVzY2FwaW5nLCBzYW5pdGlzZWQgSFRNTCB0aGF0IGFsc28gd29ya3MgZHVyaW5nIHNlcnZlciByZW5kZXJpbmcsIGFsbG93LWxpc3RlZCBVUkxzIGFuZCBwYXJhbWV0ZXJpc2VkIHF1ZXJpZXMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNCBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9pbmplY3Rpb24tYW5kLWNyb3NzLXNpdGUtc2NyaXB0aW5nIg%2Cs_lhSuv9baKXo910JT.png"
  "twitter:image:alt": "Injection and cross-site scripting · vuejs.school"
---

> Index of every page on this site: [llms.txt](https://vuejs.school/llms.txt)

# **Injection and cross-site scripting**

Keep visitors' text from running as code or as a query, with Vue's escaping, sanitised HTML that also works during server rendering, allow-listed URLs and parameterised queries.

```json
{"@context":"https://schema.org","@graph":[{"@id":"https://vuejs.school/#website","@type":"WebSite","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school/","publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#webpage","@type":"WebPage","description":"Keep visitors' text from running as code or as a query, with Vue's escaping, sanitised HTML that also works during server rendering, allow-listed URLs and parameterised queries.","name":"Injection and cross-site scripting","url":"https://vuejs.school/learn/security/injection-and-cross-site-scripting","breadcrumb":{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#breadcrumb"},"isPartOf":{"@id":"https://vuejs.school/#website"},"potentialAction":[{"@type":"ReadAction","target":["https://vuejs.school/learn/security/injection-and-cross-site-scripting"]}],"primaryImageOfPage":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/#identity","@type":"Organization","description":"A free AI-instructed school for Vue.js. Short tutorials, runnable code and quizzes that adapt to you.","name":"vuejs.school","url":"https://vuejs.school","logo":{"@id":"https://vuejs.school/#logo"}},{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#article","description":"Keep visitors' text from running as code or as a query, with Vue's escaping, sanitised HTML that also works during server rendering, allow-listed URLs and parameterised queries.","headline":"Injection and cross-site scripting","inLanguage":"en","isAccessibleForFree":true,"thumbnailUrl":"https://vuejs.school/_og/d/a_~SW5qZWN0aW9uIGFuZCBjcm9zcy1zaXRlIHNjcmlwdGluZyDCtyB2dWVqcy5zY2hvb2w%2Cc_OgCard.takumi%2Ctitle_Injection%2Band%2Bcross-site%2Bscripting%2Cdescription_~S2VlcCB2aXNpdG9ycycgdGV4dCBmcm9tIHJ1bm5pbmcgYXMgY29kZSBvciBhcyBhIHF1ZXJ5LCB3aXRoIFZ1ZSdzIGVzY2FwaW5nLCBzYW5pdGlzZWQgSFRNTCB0aGF0IGFsc28gd29ya3MgZHVyaW5nIHNlcnZlciByZW5kZXJpbmcsIGFsbG93LWxpc3RlZCBVUkxzIGFuZCBwYXJhbWV0ZXJpc2VkIHF1ZXJpZXMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNCBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9pbmplY3Rpb24tYW5kLWNyb3NzLXNpdGUtc2NyaXB0aW5nIg%2Cs_lhSuv9baKXo910JT.png","@type":["Article","TechArticle"],"articleSection":["Security"],"author":{"@id":"https://vuejs.school/#identity"},"image":{"@id":"https://vuejs.school/#/schema/image/1"},"isPartOf":{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#webpage"},"keywords":["XSS","v-html","isomorphic-dompurify","javascript: URLs","parameterised queries"],"mainEntityOfPage":{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#webpage"},"publisher":{"@id":"https://vuejs.school/#identity"}},{"@id":"https://vuejs.school/learn/security/injection-and-cross-site-scripting#breadcrumb","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","name":"Skill tree","item":"https://vuejs.school/track","position":1},{"@type":"ListItem","name":"Security & OWASP","item":"https://vuejs.school/track/security","position":2},{"@type":"ListItem","name":"Injection and cross-site scripting","position":3}]},{"@id":"https://vuejs.school/#logo","@type":"ImageObject","caption":"vuejs.school","contentUrl":"https://vuejs.school/apple-touch-icon.png","inLanguage":"en","url":"https://vuejs.school/apple-touch-icon.png"},{"@id":"https://vuejs.school/#/schema/image/1","@type":"ImageObject","contentUrl":"https://vuejs.school/_og/d/a_~SW5qZWN0aW9uIGFuZCBjcm9zcy1zaXRlIHNjcmlwdGluZyDCtyB2dWVqcy5zY2hvb2w%2Cc_OgCard.takumi%2Ctitle_Injection%2Band%2Bcross-site%2Bscripting%2Cdescription_~S2VlcCB2aXNpdG9ycycgdGV4dCBmcm9tIHJ1bm5pbmcgYXMgY29kZSBvciBhcyBhIHF1ZXJ5LCB3aXRoIFZ1ZSdzIGVzY2FwaW5nLCBzYW5pdGlzZWQgSFRNTCB0aGF0IGFsc28gd29ya3MgZHVyaW5nIHNlcnZlciByZW5kZXJpbmcsIGFsbG93LWxpc3RlZCBVUkxzIGFuZCBwYXJhbWV0ZXJpc2VkIHF1ZXJpZXMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNCBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9pbmplY3Rpb24tYW5kLWNyb3NzLXNpdGUtc2NyaXB0aW5nIg%2Cs_lhSuv9baKXo910JT.png","inLanguage":"en","url":"https://vuejs.school/_og/d/a_~SW5qZWN0aW9uIGFuZCBjcm9zcy1zaXRlIHNjcmlwdGluZyDCtyB2dWVqcy5zY2hvb2w%2Cc_OgCard.takumi%2Ctitle_Injection%2Band%2Bcross-site%2Bscripting%2Cdescription_~S2VlcCB2aXNpdG9ycycgdGV4dCBmcm9tIHJ1bm5pbmcgYXMgY29kZSBvciBhcyBhIHF1ZXJ5LCB3aXRoIFZ1ZSdzIGVzY2FwaW5nLCBzYW5pdGlzZWQgSFRNTCB0aGF0IGFsc28gd29ya3MgZHVyaW5nIHNlcnZlciByZW5kZXJpbmcsIGFsbG93LWxpc3RlZCBVUkxzIGFuZCBwYXJhbWV0ZXJpc2VkIHF1ZXJpZXMu%2Ceyebrow_~U2VjdXJpdHkgJiBPV0FTUCDCtyBMZXNzb24gNCBvZiA3%2Ctint_lilac%2Cp_Ii9sZWFybi9zZWN1cml0eS9pbmplY3Rpb24tYW5kLWNyb3NzLXNpdGUtc2NyaXB0aW5nIg%2Cs_lhSuv9baKXo910JT.png"}]}
```