ssrAttribute

Renders one attribute as markup with a leading space, or "" when the attribute is absent: the helper the compiler's server output calls for a dynamic attribute.

Renders one attribute as markup with a leading space, or "" when the attribute is absent: the helper the compiler's server output calls for a dynamic attribute. It applies the client's value rules and URL check, so server and client agree on what is written.

null, undefined and false give "" (except false on aria-*, data-*, draggable, spellcheck and contenteditable, which is written as "false"); true writes ="" (or "true" for those same names). Other values are written as String(value), HTML-escaped.
URL attributes whose value would run script are dropped, with the check of isUnsafeUrlAttribute (including the SVG animation attributes values, from, to, by).
on* names are dropped: event handlers never reach markup.
Accessors are called (untracked) until a plain value remains.

Import#

import { ssrAttribute } from "@shadow-js/web/server";

Signature#

function ssrAttribute(name: string, value: unknown, isBoolean = false): string

Parameters#

Name	Description
`name`	Attribute name, matching `[A-Za-z_:][A-Za-z0-9_:.-]*`. It is validated before anything else, so an invalid name always throws.
`value`	The value, or an accessor of it.
`isBoolean`	`true` for a presence attribute such as `disabled`: a truthy value writes the bare name, a falsy one writes nothing. Default: `false`.

Returns#

Markup such as ' title="a&b"', or "".

Throws#

TypeError INVALID_ATTRIBUTE_NAME for an invalid name, and UNRECOGNIZED_INSERT_VALUE when the value is a symbol.

Examples#

import { ssrAttribute } from "@shadow-js/web/server";

ssrAttribute("title", "Tom & Jerry"); // ' title="Tom &amp; Jerry"'
ssrAttribute("disabled", true, true); // " disabled"
ssrAttribute("href", "javascript:alert(1)"); // ""