 trusted string, any asynchronous javascript call points within the HTML string will be triggered and run with the authorization level of the user viewing the page.</p>
<p>There are many ways in which an HTML string may contain executable code. The most common ways to inject security attacks are to add an <code>onload</code> or <code>onerror</code> attributes in <code>&lt;img&gt;</code> or <code>&lt;iframe&gt;</code> tags, and to use unbalanced quotes such as <code>&quot; onerror=&quot;alert(1)</code> to in