# UNSAFE_HTML_SINK: HTML written from a string

> HTML written from a string

> Esta página ainda não tem tradução para o português; este é o texto em inglês. (This page is not translated yet: the English text follows.)

| Severity | Fault                         | Stage        |
| -------- | ----------------------------- | ------------ |
| error    | customer (the source package) | build output |

## What it means

The component writes as HTML (innerHTML, outerHTML, insertAdjacentHTML, srcdoc, setHTMLUnsafe, createContextualFragment or dangerouslySetInnerHTML) a string that is not a fixed literal, or a literal that runs script (a <script> element, an on… handler attribute, a javascript: URL). When the string comes from a prop, an attribute of the page or an API, markup such as <img onerror> in it runs script in the host page (rule html-sink).

## How to fix

Render the content with JSX ({message} is escaped), or set textContent; for formatting, accept structured data (a list of paragraphs, bold ranges) instead of HTML.