Comment by untog

Right, but the point is that React is disciplined for you. You never do any manual HTML manipulation so you don't have to worry about injection issues.