Raw HTML with v-html in Vue

Introduction

Sometimes you want to show HTML code directly inside your Vue app. The v-html directive lets you do that by inserting raw HTML into your page.

Displaying user-generated content that includes HTML formatting, like comments or posts.

Showing formatted text from a CMS or external source that comes as HTML.

Embedding small HTML snippets like icons or styled text inside your component.

Rendering HTML content that changes dynamically based on user input or API data.

Syntax

Vue

<element v-html="rawHtmlContent"></element>

The value inside v-html must be a string containing valid HTML.

Vue will replace the element's inner content with this HTML.

Examples

This will insert the HTML stored in the message variable inside the div.

Vue

<div v-html="message"></div>

Directly using a string with HTML tags inside v-html to render formatted text.

Vue

<p v-html="'<strong>Bold text</strong> and <em>italic text</em>'"></p>

Sample Program

This Vue component shows how to use v-html to display raw HTML stored in a reactive variable. The HTML tags inside the string are rendered as formatted text.

Vue

<template>
  <div>
    <h2>Raw HTML Example</h2>
    <div v-html="rawHtml"></div>
  </div>
</template>

<script setup>
import { ref } from 'vue'

const rawHtml = ref('<p>This is <strong>bold</strong> and this is <em>italic</em>.</p>')
</script>

Important Notes

Be careful with v-html because it can open security risks if you insert untrusted HTML (like user input) without cleaning it first.

Use v-html only when you trust the HTML content or sanitize it properly.

Summary

v-html lets you insert raw HTML inside your Vue components.

It replaces the element's inner content with the HTML string you provide.

Always be cautious about security when using v-html.

Practice

1. What does the v-html directive do in Vue?

easy

A. It listens for user input events.

B. It binds a JavaScript object to the element.

C. It inserts raw HTML content inside an element.

D. It applies CSS styles dynamically.

Solution

1. Step 1: Understand the purpose of v-html

   The v-html directive is used to insert raw HTML content inside an element in Vue.

2. Step 2: Compare with other options

   Other options describe different Vue features like event listening or styling, which are unrelated to v-html.

3. Final Answer:

   It inserts raw HTML content inside an element. -> Option C

4. Quick Check:

   v-html = inserts raw HTML [OK]

Hint: Remember: v-html inserts raw HTML inside elements [OK]

Common Mistakes:

• Confusing v-html with event binding
• Thinking v-html applies styles
• Assuming v-html binds JavaScript objects

2. Which of the following is the correct syntax to use v-html in a Vue template?

easy

A.

B.

C.

D.

Solution

1. Step 1: Identify correct directive syntax

   The correct directive to insert raw HTML is v-html, used as v-html="rawHtml".

2. Step 2: Check other options for correctness

   uses a non-existent directive :html.

   uses v-text which inserts plain text, not HTML.

   uses an invalid directive v-bind-html.

3. Final Answer:

   <div v-html="rawHtml"></div> -> Option B

4. Quick Check:

   Correct syntax = v-html="variable" [OK]

Hint: Use v-html="variable" to insert raw HTML [OK]

Common Mistakes:

• Using v-text instead of v-html
• Trying v-bind-html which is invalid
• Using shorthand :html which doesn't exist

3. Given the Vue template and data below, what will be rendered inside the div?

<template>
  <div v-html="htmlContent"></div>
</template>

<script setup>
const htmlContent = '<strong>Hello</strong> <em>Vue</em>!'
</script>

medium

A. Hello Vue! (formatted with bold and italic)

B. <strong>Hello</strong> <em>Vue</em>! (raw text with tags visible)

C. Hello Vue! (plain text without formatting)

D. An error occurs because of invalid HTML

Solution

1. Step 1: Understand v-html rendering

   The v-html directive inserts the HTML string as actual HTML, so tags like <strong> and <em> become formatted text.

2. Step 2: Analyze the given HTML string

   The string contains <strong>Hello</strong> and <em>Vue</em>, so the output will show "Hello" in bold and "Vue" in italic.

3. Final Answer:

   <strong>Hello</strong> <em>Vue</em>! (formatted with bold and italic) -> Option A

4. Quick Check:

   v-html renders HTML tags as formatted content [OK]

Hint: v-html renders HTML tags as formatted content, not plain text [OK]

Common Mistakes:

• Expecting raw HTML tags to show as text
• Confusing v-html with v-text
• Assuming an error occurs with HTML tags

4. What is the main issue with this Vue template?

<template>
  <div v-html=htmlContent></div>
</template>

<script setup>
const htmlContent = '<p>Hello</p>'
</script>

medium

A. The v-html directive is missing quotes around the binding expression.

B. The htmlContent variable is not reactive.

C. The HTML string is invalid and causes an error.

D. v-html cannot be used inside a <div> element.

Solution

1. Step 1: Check v-html syntax

   The directive value must be quoted, like v-html="htmlContent". Here it is missing quotes.

2. Step 2: Verify other options

   The variable is valid and reactive by default. The HTML string is valid. v-html works on any element including div.

3. Final Answer:

   The v-html directive is missing quotes around the binding expression. -> Option A

4. Quick Check:

   v-html value must be quoted [OK]

Hint: Always put quotes around v-html binding expressions [OK]

Common Mistakes:

• Omitting quotes around v-html value
• Thinking v-html only works on certain tags
• Assuming HTML string causes errors

5. You want to display user-generated HTML safely using v-html. Which approach helps prevent security risks?

hard

A. Use v-html directly without any checks.

B. Replace v-html with v-text to render HTML tags.

C. Escape all HTML tags and then use v-html.

D. Sanitize the HTML string before binding it to v-html.

Solution

1. Step 1: Understand security risks of v-html

   Using v-html with user input can cause cross-site scripting (XSS) attacks if the HTML is not safe.

2. Step 2: Identify safe usage

   Sanitizing the HTML string removes dangerous code before inserting it, making it safe to use with v-html.

3. Step 3: Evaluate other options

   Using v-html directly is unsafe. Escaping tags then using v-html defeats the purpose. Using v-text shows raw text, not HTML.

4. Final Answer:

   Sanitize the HTML string before binding it to v-html. -> Option D

5. Quick Check:

   Sanitize user HTML before v-html to prevent XSS [OK]

Hint: Always sanitize user HTML before using v-html [OK]

Common Mistakes:

• Using v-html directly with user input
• Escaping HTML then using v-html (no effect)
• Confusing v-text with v-html for HTML rendering