# SEC-002: raw HTML from data

**Warning**: the page still builds, but this is most likely a mistake.

`raw` writes HTML without escaping it. With data in it, whoever wrote that data can put a `<script>` on the
page: if a review or a name comes from a visitor, that's cross-site scripting.

## Fails

```hypra fails
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(review: Review)
  h1 "Shoes"
  raw "{review.text}"
}
```

## Fixed

```hypra passes
page(title: "Shoes", description: "All our running shoes, from light racers to trail shoes.") {
  props(review: Review, post: Post)
  h1 "Shoes"
  p "{review.text}"
  allow("SEC-002") "the post is our own Markdown, rendered and sanitized when it's saved"
  raw "{post.html}"
}
```

Text in `p "{...}"` is escaped, so it shows exactly as written. HTML you trust gets `allow` with the reason.