So, I get that `raw` prevents htmx from being used. I get that `<script>` still works.
But I find it scary that if `user_content` is `</div><div>...` that is actually injected, as raw HTML. I would expect that the `<%= raw(user_content) %> only has access to contents of the div it is in itself, and nothing more. But instead I understand that the HTML is injected as text (?) and then re-parsed (?).
https://www.sjoerdlangkemper.nl/2024/06/26/htmx-content-secu...
So, I get that `raw` prevents htmx from being used. I get that `<script>` still works.But I find it scary that if `user_content` is `</div><div>...` that is actually injected, as raw HTML. I would expect that the `<%= raw(user_content) %> only has access to contents of the div it is in itself, and nothing more. But instead I understand that the HTML is injected as text (?) and then re-parsed (?).