title: Is it safe to only escape HTML instead of using a library like DOMPurify to prevent XSS?
body: <p>I'm currently using <a href="https://stackoverflow.com/a/12034334/962155">this answer</a> to escape my HTML before inserting it into a <code>&lt;div&gt;</code> using <code>dangerouslySetInnerHTML</code> in my app.</p>
  
  <p>However, I noticed there are also libraries like <a href="https://github.com/cure53/DOMPurify" rel="nofollow noreferrer">DOMPurify</a>, which purport to be the safer approach to escaping HTML. Except that it's approximately 1000x larger of a solution, so I'm wondering if it's necessary.</p>
  
  <p>I notice that the first solution in my answer seems to work well enough. I tried entering <code>&lt;script&gt;alert('a')&lt;/script&gt;</code> into the message box and it seemed to be escaped properly. For my purposes I'm only doing a couple simple markup transformations (bolding, italics, etc.).</p>
  
  <p>Is what I'm doing enough, or do I need a more powerful solution like DOMPurify? I rather not add the dependency if it's not necessary.</p>