# HTML Injection in ion-input

**URL:** <https://forum.ionicframework.com/t/html-injection-in-ion-input/197925>\
**Category:** Ionic Angular\
**Created:** [October 15, 2020, 9:57am UTC](https://forum.ionicframework.com/t/html-injection-in-ion-input/197925 "2020-10-15T09:57:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![rTwo](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@rTwo](https://forum.ionicframework.com/u/rTwo)\
**Post date:** [October 15, 2020, 9:57am UTC](https://forum.ionicframework.com/t/html-injection-in-ion-input/197925/1 "2020-10-15T09:57:08Z")

</div>

Hello all, I develop a demo app where user can create a post by providing following inputs(ion-input type=“text”).

While testing some user will type some HTML scripting and the result you can see on attached image.

So my question is how can we prevent this type of inputs in ionic ?

 ![Screenshot 2020-10-15 at 3.18.53 PM](https://global.discourse-cdn.com/ionicframework/original/3X/4/0/40afbf96cbe1d2a38d09bc8c66866b11c7c10236.png)

---

<div class="post-metadata">

**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\
**Post date:** [October 15, 2020, 6:11pm UTC](https://forum.ionicframework.com/t/html-injection-in-ion-input/197925/2 "2020-10-15T18:11:16Z")

</div>

> [@rTwo](#):
>
> how can we prevent this type of inputs in ionic ?

The only way I’m aware of that Ionic apps will attempt to display user-generated HTML is if you bind `innerHTML`. So if you’re doing that, don’t do that. If this HTML is being submitted to an external website, then I would consider it the responsibility of the backend. It doesn’t make any sense to me to create an honor system for front-ends to protect a vulnerable backend, because blackhats don’t obey honor systems.

---

<div class="post-metadata">

**Author:** ![rTwo](https://avatars.discourse-cdn.com/v4/letter/r/22d042/32.png) [@rTwo](https://forum.ionicframework.com/u/rTwo)\
**Post date:** [October 29, 2020, 7:04am UTC](https://forum.ionicframework.com/t/html-injection-in-ion-input/197925/3 "2020-10-29T07:04:22Z")

</div>

Thank for explaining, I did the workaround , I replace if user type some special characters like #, @, %, ^ , {, } , !, ; , \<, \> in message text so I replace this with white space so basically this will disable scripting and display as simple string. because my team leader said we need to use innerHTML for breakline message   
.

---

<div class="post-metadata">

**Author:** ![rapropos](https://sea1.discourse-cdn.com/ionicframework/user_avatar/forum.ionicframework.com/rapropos/32/100227_2.png) [@rapropos](https://forum.ionicframework.com/u/rapropos)\
**Post date:** [October 29, 2020, 6:36pm UTC](https://forum.ionicframework.com/t/html-injection-in-ion-input/197925/4 "2020-10-29T18:36:12Z")

</div>

> [@rTwo](#):
>
> my team leader said we need to use innerHTML for breakline message

I don’t agree with that, if I understand correctly. [The CSS `white-space` property](https://developer.mozilla.org/en-US/docs/Web/CSS/white-space) exists, and does not require `innerHTML` to use.