d signatures</a></p>
<hr>
<h3 id="how-it-works"><a href="#how-it-works">How it works</a></h3>
<p>By default, Mithril escapes all values in order to prevent a class of security problems called <a href="https://en.wikipedia.org/wiki/Cross-site_scripting">XSS injections</a>.</p>
<pre><code class="lang-javascript">var userContent = &quot;&lt;script&gt;alert(&#39;evil&#39;)&lt;/script&gt;&quot;
var view = m(&quot;div&quot;, userContent)

m.render(document.body, view)

// equivalent HTML
// &lt;div&gt;&amp;lt;scr