`dangerouslySetInnerHTML` is a [React](/courses/reactjs) escape hatch that lets you insert a raw [HTML](/courses/html) string directly into a DOM element. It is useful in limited situations, but it bypasses [React](/courses/reactjs)'s normal protection of treating strings as text. ### Basic Syntax ```jsx const markup = { __html: "

Hello React

" }; function Article() { return (

); } ``` The browser interprets the supplied string as [HTML](/courses/html). ### Why Is It Called dangerouslySetInnerHTML? The name is intentionally explicit because inserting raw HTML creates a security boundary. Normally: ```jsx

{content}

``` means: ```text Treat content as data/text ``` but: ```jsx

``` means conceptually: ```text Interpret this string as HTML ``` If that string contains dangerous markup, the browser may process behavior the application never intended to allow. ### Dangerous Pattern ```jsx function UserPost({ post }) { return (

); } ``` If `post.content` contains user-generated HTML that has not been sanitized, this can create an XSS vulnerability. ### Safe Alternative When You Only Need Text If content should appear exactly as text, use normal JSX: ```jsx

{post.content}

``` This should be your default whenever HTML formatting is not required. ### When Might Raw HTML Actually Be Needed? Examples include: ```text Rich text editor output CMS article content Trusted HTML generated by a controlled system Sanitized Markdown converted to HTML Legacy content stored as HTML ``` In these situations, the important rule is: ```text Untrusted HTML ↓ sanitize it ↓ only then render as raw HTML ``` ### Sanitization Example Using a trusted HTML sanitizer, conceptually: ```jsx const safeHTML = sanitize(untrustedHTML); return (

); ``` The sanitizer should remove or neutralize markup that is not allowed by your security policy. ### Do Not Confuse Validation with Sanitization Validation might answer: ```text Is this input in an expected format? ``` Sanitization answers: ```text Which parts of this HTML can safely remain? ``` For rich HTML, simply checking string length or searching for `