# NO_DANGEROUS_HTML

Unsafe creation of DOM can be done a variety of ways:

- `element.innerHTML`
- `element.outerHTML`
- `DOMParser.parseFromString()`
- `element.insertAdjacentHTML()`
- `srcdoc` on iframe elements
- `dangerouslySetInnerHTML` prop in React apps

Usage of these methods is deemed an unsafe coding practice as the HTML might result in security vulnerabilities.

## How to fix

It is recommended to instead use alternative approaches for HTML construction - such as `document.createElement()` or a HTML sanitizer.


--------------------------------------------------------------------------------
title: "NO_DOCUMENT_WRITE"
description: "Prevent unsafe usage of document.write() in your application."
last_updated: "2026-02-03T02:58:39.277Z"
source: "https://vercel.com/docs/conformance/rules/NO_DOCUMENT_WRITE"
--------------------------------------------------------------------------------