Skip to content

Commit 225389f

Browse files
committed
jQuery.parseHTML: Fix a couple typos
1 parent c0c72c6 commit 225389f

File tree

1 file changed

+2
-2
lines changed

1 file changed

+2
-2
lines changed

entries/jQuery.parseHTML.xml

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,10 @@
1818
<p><code>jQuery.parseHTML</code> uses native methods to convert the string to a set of DOM nodes, which can then be inserted into the document. These methods do render all trailing or leading text (even if that's just whitespace). To prevent trailing/leading whitespace from being converted to text nodes you can pass the HTML string through <a href="/jQuery.trim/"><code>jQuery.trim</code></a>.</p>
1919
<p>By default, the <code>context</code> is the current <code>document</code> if not specified or given as <code>null</code> or <code>undefined</code>. If the HTML was to be used in another document such as an iframe, that frame's document could be used.</p>
2020
<h2>Security Considerations</h2>
21-
<p>Most jQuery APIs that accept HTML strings will run scripts that are included in the HTML. <code>jQuery.parseHTML</code> does not run script in the parsed HTML unless <code>keepScripts</code> is explicitly <code>true</code>. However, it is still possible in most environments to execute script indirectly, for example via the <code>&lt;img onerror&gt;</code> attribute. The caller should be aware of this and guard against it by cleaning or escaping any untrusted inputs from sources such as the URL or cookies. For future compatibility, callers should not depend on the ability to run <em>any</em> script content when <code>keepScripts</code> is unspecified or <code>false</code>.</p>
21+
<p>Most jQuery APIs that accept HTML strings will run scripts that are included in the HTML. <code>jQuery.parseHTML</code> does not run scripts in the parsed HTML unless <code>keepScripts</code> is explicitly <code>true</code>. However, it is still possible in most environments to execute scripts indirectly, for example via the <code>&lt;img onerror&gt;</code> attribute. The caller should be aware of this and guard against it by cleaning or escaping any untrusted inputs from sources such as the URL or cookies. For future compatibility, callers should not depend on the ability to run <em>any</em> script content when <code>keepScripts</code> is unspecified or <code>false</code>.</p>
2222
</longdesc>
2323
<example>
24-
<desc>Create an array of Dom nodes using an HTML string and insert it into a div.</desc>
24+
<desc>Create an array of DOM nodes using an HTML string and insert it into a div.</desc>
2525
<html><![CDATA[
2626
<div id="log">
2727
<h3>Content:</h3>

0 commit comments

Comments
 (0)