Path: csiph.com!feeder.erje.net!2.eu.feeder.erje.net!news.mb-net.net!open-news-network.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: inner outer html and appendchild
Date: Mon, 29 May 2017 19:04:48 +0200
Organization: PointedEars Software (PES)
Lines: 30
Message-ID: <5274343.lOV4Wx5bFT@PointedEars.de>
References: <4N-dnWxtPtO7I7bEnZ2dnUU7-KPNnZ2d@westnet.com.au>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
NNTP-Posting-Host: 95.237.197.178.dynamic.wless.lssmb00p-cgnat.res.cust.swisscom.ch
Mime-Version: 1.0
Content-Type: text/plain; charset="ISO-8859-1"
Content-Transfer-Encoding: 7Bit
X-Trace: gwaiyur.mb-net.net 1496077489 6777 178.197.237.95 (29 May 2017 17:04:49 GMT)
X-Complaints-To: abuse@open-news-network.org
NNTP-Posting-Date: Mon, 29 May 2017 17:04:49 +0000 (UTC)
User-Agent: KNode/4.14.2
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
Xref: csiph.com comp.lang.javascript:33427

Andrew Poulos wrote:

> I know about the differences between innerHTML and appendChild but I'm
> in a bit of a bind. If the uses passes a valid html element as a string
> how do I add it to the document without needing to parse the sting or
> contain it in a DIV?
>  
> For example, the users passes (the dots are for brevity)
>    str = "<img id='.' src='..jpg' alt='.' style='.' >";
> or
>    str = "<div id='.' style='.'><p id='.' style='.'>Text <span
> style='.'></span></p></div";

  document.body.innerHTML += str;

is the most compatible, straightforward solution.

But document.body.insertAdjacentHTML(), as Martin suggested, is probably the 
more efficient one.

That said, you SHOULD NOT allow the user to pass HTML in the first place; 
that is a big security risk as it allows Cross-Site Scripting (XSS) attacks.

<https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)>
 
-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.