
Security News
Federal Audit Finds NIST Wasted Funds With No Plan to Clear NVD Backlog
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.
@prairielearn/html
Advanced tools
@prairielearn/htmlUtilities for easily rendering HTML from within JavaScript.
The html tagged template literal can be used to render HTML while ensuring that any interpolated values are properly escaped.
By convention, HTML templates are located in *.html.ts files.
// Hello.html.ts
import { html } from '@prairielearn/html';
export function Hello({ name }: { name: string }) {
return html`<div>Hello, ${name}!</div>`;
}
This can then be used to render a string:
import { Hello } from './Hello.html.ts';
console.log(Hello({ name: 'Anjali' }).toString());
// Prints "<div>Hello, Anjali!</div>"
If you want to pre-escape some HTML, you can wrap it in escapeHtml to avoid escaping it twice. This is useful if you want to inline some HTML into an attribute, for instance with a Bootstrap popover.
import { html, escapeHtml } from '@prairielearn/html';
console.log(html`
<button data-bs-toggle="popover" data-bs-content="${escapeHtml(html`<div>Content here</div>`)}">
Open popover
</button>
`);
In the past, PrairieLearn used EJS to render most views. However, using a tagged template literal and pure JavaScript to render views has a number of advantages:
html tagged template literal; EJS does not have any automatic formatters.If you want to use existing EJS partials inside of an html tagged template literal, check out the @prairielearn/html-ejs package. EJS-related functionality is deliberately located in a separate package so that @prairielearn/html can be used in the browser, since the ejs package makes use of Node-only features. Note, though, that this package is no longer used in PrairieLearn itself, and as such will no longer be actively maintained.
FAQs
Utilities for easily rendering HTML from within JavaScript.
We found that @prairielearn/html demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Federal audit finds NIST lacked a plan to clear the NVD backlog, wasted funds on duplicate work, and delayed use of CISA data.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.