docs: make it clear that Element::push_html should b eavoided

Signed-off-by: Lars Wirzenius <liw@liw.fi>
Sponsored-by: author

1 files changed, 3 insertions, 1 deletions

diff --git a/src/lib.rs b/src/lib.rs
index 37747d2..fe22010 100644
--- a/src/lib.rs
+++ b/src/lib.rs
@@ -553,7 +553,9 @@ impl Element {
     }
 
     /// Append HTML to element. It will NOT be escaped, when the
-    /// element is serialized.
+    /// element is serialized. This is an easy to inject arbitrary
+    /// junk into the HTML. No validation is done. You should avoid
+    /// this if you can.
     pub fn push_html(&mut self, html: &str) {
         self.children.push(Content::html(html));
     }