diff --git a/src/v2/guide/syntax.md b/src/v2/guide/syntax.md index ea7c09deec..ddd821ca44 100644 --- a/src/v2/guide/syntax.md +++ b/src/v2/guide/syntax.md @@ -33,10 +33,28 @@ You can also perform one-time interpolations that do not update on data change b The double mustaches interprets the data as plain text, not HTML. In order to output real HTML, you will need to use the `v-html` directive: ``` html -
+

Using mustaches: {{ rawHtml }}

+

Using v-html directive:

``` -The contents of this `div` will be replaced with the value of the `rawHtml` property, interpreted as plain HTML - data bindings are ignored. Note that you cannot use `v-html` to compose template partials, because Vue is not a string-based templating engine. Instead, components are preferred as the fundamental unit for UI reuse and composition. +{% raw %} +
+

Using mustaches: {{ rawHtml }}

+

Using v-html directive:

+
+ +{% endraw %} + +The contents of the `span` will be replaced with the value of the `rawHtml` property, interpreted as plain HTML - data bindings are ignored. Note that you cannot use `v-html` to compose template partials, because Vue is not a string-based templating engine. Instead, components are preferred as the fundamental unit for UI reuse and composition.

Dynamically rendering arbitrary HTML on your website can be very dangerous because it can easily lead to [XSS vulnerabilities](https://en.wikipedia.org/wiki/Cross-site_scripting). Only use HTML interpolation on trusted content and **never** on user-provided content.