How do you use $sce.trustAsHtml(string) to replicate ng-bind-html-unsafe in Angular 1.2+

前端 未结 10 1676
别跟我提以往
别跟我提以往 2020-11-22 03:51

ng-bind-html-unsafe was removed in Angular 1.2

I\'m trying to implement something where I need to use ng-bind-html-unsafe. In the docs and

10条回答
  •  我寻月下人不归
    2020-11-22 04:14

    Personally I sanitize all my data with some PHP libraries before going into the database so there's no need for another XSS filter for me.

    From AngularJS 1.0.8

    directives.directive('ngBindHtmlUnsafe', [function() {
        return function(scope, element, attr) {
            element.addClass('ng-binding').data('$binding', attr.ngBindHtmlUnsafe);
            scope.$watch(attr.ngBindHtmlUnsafe, function ngBindHtmlUnsafeWatchAction(value) {
                element.html(value || '');
            });
        }
    }]);
    

    To use:

    To disable $sce:

    app.config(['$sceProvider', function($sceProvider) {
        $sceProvider.enabled(false);
    }]);
    

提交回复
热议问题