Is <b>this</b> bold? Escaping by default
Every value you put into JSX is escaped, so <script>alert('xss')</script> stays text. This post proves it.
Look at the title of this post: it contains a <b> tag, yet it isn't bold. Jeasx escapes every value rendered in JSX, so text written by users, such as the posts on this blog, can never inject markup or scripts into the page.
<script>alert('If you see this as a dialog, something went wrong.')</script>
When you really want to output trusted HTML, for example from a Markdown renderer, you opt in explicitly with the html helper. Safe by default, unsafe only on purpose.