W3cubDocs

/Web APIs

TrustedTypePolicy: createHTML() method

The createHTML() method of the TrustedTypePolicy interface creates a TrustedHTML object using a policy created by TrustedTypePolicyFactory.createPolicy().

Syntax

js

createHTML(input)
createHTML(input, args)

Parameters

input

A string containing the string to be sanitized by the policy.

args Optional

Additional arguments to be passed to the function represented by TrustedTypePolicy.

Return value

A TrustedHTML object.

Exceptions

TypeError

Thrown if TrustedTypePolicy does not contain a function to run on the input.

Examples

In the below example a string containing a potentially dangerous script is used as the input for createHTML(). Dangerous code inserted by a user could then be sanitized before insertion into any injection sink.

js

const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");

Specifications

Browser compatibility

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari WebView Android Chrome Android Firefox for Android Opera Android Safari on IOS Samsung Internet
createHTML 83 83 No No 69 No 83 83 No 59 No 13.0

© 2005–2023 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/API/TrustedTypePolicy/createHTML