
Product
Introducing Custom Pull Request Alert Comment Headers
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.
apply-html
Advanced tools
It's .innerHTML = ''
for the 21st century!
Yet another library to diff and patch an existing DOM tree by efficiently comparing it to a string. Why? This library is a little bit different than others. It makes use of an HTML <template>
's unique ability to create an inert document fragment, featuring:
The live DOM is then patched with the inert fragment using a hyper-fast diffing algorithm for real DOM nodes. This ensures that things only start happening if and when they're supposed to, organically.
Play with it on CodePen.
$ npm install --save apply-html
or
<script src="https://wzrd.in/standalone/apply-html"></script>
or
<script type="module">
import { apply, html } from 'https://unpkg.com/apply-html?module';
</script>
const { apply } = require('apply-html');
apply(document.body, '<h1 class="day">Hello World</h1>');
console.log(document.body.innerHTML);
// -> <h1 class="day">Hello World</h1>
apply(document.body, '<h1 class="night">Goodnight Moon</h1>');
console.log(document.body.innerHTML);
// -> <h1 class="night">Goodnight Moon</h1>
const { apply, html, raw } = require('apply-html');
const foo = '<em>foo</em>';
const bar = raw('<em>bar</em>');
const baz = html`<strong>baz</strong>`;
apply(document.body, html`
${foo}
${bar}
${baz}
`);
console.log(document.body.innerHTML);
// -> <em>foo</em>
// -> <em>bar</em>
// -> <strong>baz</strong>
The html
and raw
functions never touch the DOM so they're completely safe to use server-side.
const http = require('http');
const { html } = require('apply-html');
const content = html`
<h1>Hello <em>World</em></h1>
<p>How are you today?</p>
`;
module.exports = http
.createServer((req, res) => res.end(content.toString()))
.listen(3000);
apply(element, string): Element
element
{Element}
DOM element with children to be patched.string
{String|SafeString}
String or SafeString containing safe HTML to render.Updates the content of the given element, making the fewest possible changes required to match the given string of HTML. The string is converted into an HTML <template>
and the resulting DOM trees are compared. Returns the updated element.
html`string`: SafeString
A template tag that creates a new SafeString containing a string of HTML. Interpolated values are serialized based on type:
Array
- Items are serialized then joined with an empty string (''
).Boolean|null|undefined
- Converted to an empty string (''
).Function
- Throws a TypeError
.Number
- Inserted as-is.Object
- Converted to an HTML-encoded JSON blob.SafeString
- Inserted as-is.String
- HTML-encoded to safeguard against XSS. To opt out of escaping, use raw()
.raw(string): SafeString
string
{String}
String of safe HTML.Wraps a string in a SafeString to indicate that it's safe to be inserted into the document. Only use on trusted strings to safeguard against XSS.
.raw
{String}
The wrapped string.
.length
{Number}
Length of the wrapped string. Read only.
.toJSON(): String
Returns the raw string.
.toString(): String
Returns the raw string.
Standing on the shoulders of these giants:
MIT © Shannon Moeller
FAQs
It's `.innerHTML = ''` for the 21st century.
The npm package apply-html receives a total of 4 weekly downloads. As such, apply-html popularity was classified as not popular.
We found that apply-html demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket now lets you customize pull request alert headers, helping security teams share clear guidance right in PRs to speed reviews and reduce back-and-forth.
Product
Socket's Rust support is moving to Beta: all users can scan Cargo projects and generate SBOMs, including Cargo.toml-only crates, with Rust-aware supply chain checks.
Product
Socket Fix 2.0 brings targeted CVE remediation, smarter upgrade planning, and broader ecosystem support to help developers get to zero alerts.