diff --git a/src/v2/guide/syntax.md b/src/v2/guide/syntax.md index ea7c09deec..ddd821ca44 100644 --- a/src/v2/guide/syntax.md +++ b/src/v2/guide/syntax.md @@ -33,10 +33,28 @@ You can also perform one-time interpolations that do not update on data change b The double mustaches interprets the data as plain text, not HTML. In order to output real HTML, you will need to use the `v-html` directive: ``` html -
+Using mustaches: {{ rawHtml }}
+Using v-html directive:
``` -The contents of this `div` will be replaced with the value of the `rawHtml` property, interpreted as plain HTML - data bindings are ignored. Note that you cannot use `v-html` to compose template partials, because Vue is not a string-based templating engine. Instead, components are preferred as the fundamental unit for UI reuse and composition. +{% raw %} +Using mustaches: {{ rawHtml }}
+Using v-html directive:
+Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to [XSS vulnerabilities](https://en.wikipedia.org/wiki/Cross-site_scripting). Only use HTML interpolation on trusted content and **never** on user-provided content.