TrustedHTML.toString()

The toString() method of the TrustedHTML interface returns a string which may safely inserted into an injection sink.

Syntax

var str = TrustedHTML.toString();

Return value

A string containing the sanitized HTML.

Examples

The constant escaped is an object created via the Trusted Types policy escapeHTMLPolicy. The toString() method returns a string to safely insert into a document.

const escapeHTMLPolicy = trustedTypes.createPolicy("myEscapePolicy", {
  createHTML: (string) => string.replace(/\>/g, "<")
});

const escaped = escapeHTMLPolicy.createHTML("<img src=x onerror=alert(1)>");
console.log(escaped.toString());

Specifications

Browser compatibility

Desktop Mobile
Chrome Edge Firefox Internet Explorer Opera Safari WebView Android Chrome Android Firefox for Android Opera Android Safari on IOS Samsung Internet
toString
83
83
No
No
69
No
83
83
No
59
No
13.0

© 2005–2021 MDN contributors.
Licensed under the Creative Commons Attribution-ShareAlike License v2.5 or later.
https://developer.mozilla.org/en-US/docs/Web/API/TrustedHTML/toString