A structured lesson workspace with readable content, hands-on examples, and a clean path to completion.
Treat the markup here as a contract with the browser. The more precisely you express the contract, the less repair work the browser has to invent. In this lesson, the focus is HTML-driven attack surfaces in content, navigation, embedding, and forms. That matters because HTML is interpreted by a parser and then exposed to browser features such as navigation, accessibility tooling, form controls, media handling, and script APIs. A correct-looking screenshot can still hide a poor document model.
| Decision | Why it matters |
|---|---|
| Native element | Carries browser semantics and default behavior. |
| Attribute | Refines the element without replacing its meaning. |
| CSS/JS hook | Adds presentation or behavior around the existing structure. |
<div data-user-content="...">User text must remain text, not executable markup.</div>
Warning: invalid or overly permissive markup may still render. Rendering is not proof that the document model is correct.
Start with the smallest meaningful example. The working snippet demonstrates the core syntax, but the important part is what each piece contributes: the element supplies semantics or behavior, attributes refine that meaning, and surrounding structure gives the browser context. Don't add markup just because a framework or copied example happens to include it.
The browser's defaults are part of the behavior you are learning. Prefer native semantics first, then test the exact combination of attributes and content you plan to ship.
<p id="name"></p><script>document.querySelector("#name").textContent = userName;</script>
In a team codebase, the expensive bugs usually come from assumptions. Someone assumes an anchor is just a button with a different visual style, that a placeholder is a label, that an iframe is only a rectangle, or that a client-side constraint is security. The safe engineering move is to name the browser behavior you actually depend on and encode it directly in HTML.
The browser's defaults are part of the behavior you are learning. Prefer native semantics first, then test the exact combination of attributes and content you plan to ship.
Engineering judgment: prefer the native HTML behavior described here before reaching for a custom widget.
Field tip: for understanding html-related security risks, test both the ordinary path and the first case that makes your assumptions false.
Finish the lesson once you have worked through the material. This awards ★ 20 XP.