[TekMol]

    If the state comes from the user, they
    can add script tags into the html

How is that different with React?

And how is it a problem? A rendering engine would set the html of some element to the html I think?

This ...

    document.body.innerHTML='<script>alert(1)</script>';

...does not execute the script.

[leonardopainter]

<img src='x' onerror='alert(1)'>

https://developer.mozilla.org/en-US/docs/Web/API/Element/inn...

[leonardopainter]

In terms of the placeholders in JSX, no they are escaped.

[TekMol]

True.

But the same issue with reacts way.