It is safe to embed user input in JSX:
像這樣在JSX中嵌入用戶輸入是安全的：
const title = response.potentiallyMaliciousInput;
// This is safe:
const element =<h1>{title}</h1>;
By default, React DOM escapes any values embedded in JSX before rendering them.
默認(rèn)情況，React DOM會(huì)在渲染前對(duì)嵌入JSX內(nèi)的值進(jìn)行轉(zhuǎn)意。
Thus it ensures that you can never inject anything that's not explicitly written in your application.
這樣做將確保你的應(yīng)用不會(huì)被沒(méi)有明確寫的的東西注入。
Everything is converted to a string before being rendered. This helps prevent XSS (cross-site-scripting) attacks.
每個(gè)東西再被渲染前都會(huì)被轉(zhuǎn)換為字符串。這樣做會(huì)有效的防止XSS（跨站腳本）攻擊。
