# Html in Notification Pop-Up

**URL:** <https://discourse.nodered.org/t/html-in-notification-pop-up/24114>\
**Category:** Dashboard\
**Created:** [2 April 2020 21:18 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114 "2020-04-02T21:18:14Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![d0d04m3](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/d0d04m3/32/19965_2.png) [@d0d04m3](https://discourse.nodered.org/u/d0d04m3)\
**Post date:** [2 April 2020 21:18 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/1 "2020-04-02T21:18:14Z")

</div>

hi I use Notification Pop-Up  
it is possible to show html content in a popup dialog  
or if any other node for send html to popup like messageBox in jquery  
thx

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [2 April 2020 21:36 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/2 "2020-04-02T21:36:52Z")

</div>

I wonder what this option does...

 ![image](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/4/1/418881bb5a2e6ed7feb694c42077ac7e34392fde.png)

---

<div class="post-metadata">

**Author:** ![d0d04m3](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/d0d04m3/32/19965_2.png) [@d0d04m3](https://discourse.nodered.org/u/d0d04m3)\
**Post date:** [2 April 2020 21:48 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/3 "2020-04-02T21:48:11Z")

</div>

thx  
am sorry  
I did not pay attention

---

<div class="post-metadata">

**Author:** ![realjax](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/realjax/32/895_2.png) [@realjax](https://discourse.nodered.org/u/realjax)\
**Post date:** [3 April 2020 08:32 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/4 "2020-04-03T08:32:32Z")

</div>

🙂 In the OP's defence, it is slightly confusing.

It should probably read 'Accept raw HTML/JavaScript in msg.payload to format popup.'

Unless of course the user is allowed to type and send HTML code in the input field that pop's up. In which case I have said nothing. 🙂

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [3 April 2020 08:46 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/5 "2020-04-03T08:46:19Z")

</div>

good shout - will clarify as you suggest.

Note: the reason this is optional is of course that it is indeed a way to do code injection so you need to ensure you have sanitised any html/js you send to the notification - and don't allow any previous user input to leak through.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [17 April 2020 08:46 UTC](https://discourse.nodered.org/t/html-in-notification-pop-up/24114/6 "2020-04-17T08:46:29Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.