From 4ff28bee2a644bc22a3fd62486f0395fbb0ccce8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ren=C3=A9e=20Kooi?= <renee@kooi.me>
Date: Wed, 29 Jul 2020 16:43:20 +0200
Subject: [PATCH] website: also escape output in dragdrop example

---
 website/src/examples/dragdrop/app.es6 | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/website/src/examples/dragdrop/app.es6 b/website/src/examples/dragdrop/app.es6
index 1890158ec..dd57754fb 100644
--- a/website/src/examples/dragdrop/app.es6
+++ b/website/src/examples/dragdrop/app.es6
@@ -11,8 +11,14 @@ const onUploadSuccess = (elForUploadedFiles) =>
     const url = response.uploadURL
     const fileName = file.name
 
-    document.querySelector(elForUploadedFiles).innerHTML +=
-      `<li><a href="${url}" target="_blank">${fileName}</a></li>`
+    const li = document.createElement('li')
+    const a = document.createElement('a')
+    a.href = url
+    a.target = '_blank'
+    a.appendChild(document.createTextNode(fileName))
+    li.appendChild(a)
+
+    document.querySelector(elForUploadedFiles).appendChild(li)
   }
 
 const uppyOne = new Uppy({ debug: true, autoProceed: true })