String literals create Text nodes, which are treated as strings by the browser. Hence, even if the expression contains a <script> tag you can't fall for XSS and such security issues, unless of course you wrap the expression in a <script> block.
Literals and Expressions
Literals#
If expressions resolve to types that implement Display, they will be converted to strings and inserted into the DOM as a Text node.
note
All display text must be enclosed by {} blocks because the text is handled as an expression. This is the largest deviation from normal HTML syntax that Yew makes.
use *;
let text = "lorem ipsum";
html!;
Expressions#
You can insert expressions in your HTML using {} blocks, as long as they resolve to Html
use *;
let show_link = true;
html! ;
It often makes sense to extract these expressions into functions or closures to optimize for readability:
use *;
let show_link = true;
let maybe_display_link = move || ;
html! ;