Display unescaped HTML in Vue.js

Question

How can I manage to get HTML interpreted inside a mustache binding? At the moment the break (<br />) is just displayed/escaped.

Small Vue app:

var logapp = new Vue({
  el: '#logapp',
  data: {
    title: 'Logs',
    logs: [
      { status: true, type: 'Import', desc: 'Learn<br />JavaScript', date: '11.11.2015', id: 1  },
      { status: true, type: 'Import', desc: 'Learn<br />JavaScript', date: '11.11.2015', id: 1  }
    ]
  }
})

And here is the template:

<div id="logapp">    
    <table>
        <tbody>
            <tr v-repeat="logs">
                <td>{{fail}}</td>
                <td>{{type}}</td>
                <td>{{description}}</td>
                <td>{{stamp}}</td>
                <td>{{id}}</td>
            </tr>
        </tbody>
    </table>
</div>

doing unescaped HTML for line-breaks is overkill, just wanted to mention that! it's a big security risk — Ryan Taylor
– Ryan Taylor, Commented Mar 11, 2019 at 19:28
@iiirxs if you don't escape the HTML it can load arbitrary javascript etc. you just wanna make sure users can't input stuff there even indirectly. it's called code injection — Ryan Taylor
– Ryan Taylor, Commented Feb 14, 2021 at 22:13
how can this be unsafe since it's provided by the application itself and users have no way to inject malicious code? — iiirxs
– iiirxs, Commented Feb 18, 2021 at 10:42
I honestly hear that sort of justification all the time. Yes, everyone seems to have a legitimate use case for dynamic code execution, and yes, if you have absolute control of the output and you're thoroughly sanitizing it as a safeguard, sure, knock yourself out - but unless it's strictly needed, why would you? Why play with fire? The above scenario can easily be worked around with whitespace: pre-wrap + \n. Why take steps to enable and downplay such a classic vulnerability in computer science? It's tiresome to make the case against this every time. — gyohza
– gyohza, Commented Jan 27, 2024 at 6:29

Penny Liu · Accepted Answer · 2022-03-13 12:18:33Z

390

You can use the v-html directive to show it. like this:

<td v-html="desc"></td>

edited Mar 13, 2022 at 12:18

Penny Liu

18k5 gold badges89 silver badges109 bronze badges

answered Jun 24, 2015 at 2:20

王开朗

4,0812 gold badges12 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

5 Comments

Yauheni Prakopchyk Over a year ago

That one actually works in vue2. First one trows on compile.

Zum Dummi Over a year ago

i have a problem with v-html to limit the text, ? is that possible to limit text in v-html ? i tried, it was failed

PiggyPlex Over a year ago

Try slicing the variable

LastM4N Over a year ago

Jut one comment for v-html. Even if this does the job, we need to have in mind that we should render v-html elements which are sanitized otherwise we expose our front end app to xss vulnerabilities. Official doc here: vuejs.org/v2/guide/security.html

lfmunoz Over a year ago

if I have escaped html and unescaped html, how do I make it so it doesn't automatically unescape html?

shA.t · Accepted Answer · 2025-05-22 08:09:01Z

238

Starting with Vue2, the triple braces were deprecated, you are to use v-html:

<div v-html="task.html_content"> </div>

It is unclear from the documentation link as to what we are supposed to place inside v-html, your variables go inside v-html.

Also, v-html works only with <div> or <span> but not with <template>.

If you want to see this live in an app, click here.

edited May 22 at 8:09

shA.t

17.1k5 gold badges59 silver badges121 bronze badges

answered Mar 26, 2017 at 3:50

thewhitetulip

3,3093 gold badges23 silver badges26 bronze badges

1 Comment

domih Over a year ago

"but not with <template>" is the important part here if you come from Angular.js and look for something like <ng-include>

tony19 · Accepted Answer · 2022-07-15 19:40:56Z

98

You can read that here

If you use

{{<br />}}

it'll be escaped. If you want raw html, you gotta use

{{{<br />}}}

EDIT (Feb 5 2017): As @hitautodestruct points out, in vue 2 you should use v-html instead of triple curly braces.

edited Jul 15, 2022 at 19:40

tony19

140k24 gold badges281 silver badges354 bronze badges

answered Jun 16, 2015 at 22:42

zeratulmdq

1,49416 silver badges15 bronze badges

3 Comments

hitautodestruct Over a year ago

Please note that in vue 2.0 the triple moustache has been deprecated you should use v-html instead.

Илья Зелень Over a year ago

I do not like in the new method that I often have to create an unnecessary element, purely so that it serves to insert html. This sometimes breaks styles and creates unnecessary nesting.

Jonathan Over a year ago

@ИльяЗеленько really must agree with you on this. Particularly true if you are trying to feed text content as a <slot>... you must create a new element

Shair Haider · Accepted Answer · 2019-06-25 05:20:24Z

11

You have to use v-html directive for displaying html content inside a vue component

<div v-html="html content data property"></div>

answered Jun 25, 2019 at 5:20

Shair Haider

1231 silver badge6 bronze badges

Comments

user10261970 · Accepted Answer · 2018-08-25 20:34:17Z

9

Vue by default ships with the v-html directive to show it, you bind it onto the element itself rather than using the normal moustache binding for string variables.

So for your specific example you would need:

<div id="logapp">    
    <table>
        <tbody>
            <tr v-repeat="logs">
                <td v-html="fail"></td>
                <td v-html="type"></td>
                <td v-html="description"></td>
                <td v-html="stamp"></td>
                <td v-html="id"></td>
            </tr>
        </tbody>
    </table>
</div>

answered Aug 25, 2018 at 20:34

user10261970

1 Comment

m50 Over a year ago

works with Vue.js v2.6.8

tony19 · Accepted Answer · 2022-07-15 02:48:00Z

1

Before using v-html, you have to make sure that the element which you escape is sanitized in case you allow user input, otherwise you expose your app to xss vulnerabilities.

More info here: https://v2.vuejs.org/v2/guide/security.html

I highly encourage you that instead of using v-html to use this npm package

edited Jul 15, 2022 at 2:48

tony19

140k24 gold badges281 silver badges354 bronze badges

answered Jan 13, 2021 at 10:44

LastM4N

2,2502 gold badges19 silver badges24 bronze badges

Collectives™ on Stack Overflow

Display unescaped HTML in Vue.js

6 Answers 6

5 Comments

1 Comment

3 Comments

Comments

1 Comment

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

6 Answers 6

5 Comments

1 Comment

3 Comments

Comments

1 Comment

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related