Insert HTML into your app.
Adding custom HTML to your app impacts safety, styling, and maintainability. We sanitize HTML with DOMPurify, but inserting HTML remains a developer risk. Passing untrusted code to st.html or dynamically loading external code can increase the risk of vulnerabilities in your app.
st.html content is not iframed. By default, JavaScript is ignored. To execute JavaScript contained in your HTML, set unsafe_allow_javascript=True. Use this with caution and never pass untrusted input.
| Function signature[source] | |
|---|---|
st.html(body, *, width="stretch", unsafe_allow_javascript=False) | |
| Parameters | |
body (any) | The HTML code to insert. This can be one of the following:
If the resulting HTML content is empty, Streamlit will raise an error. If body is a path to a CSS file, Streamlit will wrap the CSS content in <style> tags automatically. When the resulting HTML content only contains style tags, Streamlit will send the content to the event container instead of the main container to avoid taking up space in the app. |
width ("stretch", "content", or int) | The width of the HTML element. This can be one of the following:
|
unsafe_allow_javascript (bool) | Whether to execute JavaScript contained in your HTML. If this is False (default), JavaScript is ignored. If this is True, JavaScript is executed. Use this with caution and never pass untrusted input. |
Example
Still have questions?
Our forums are full of helpful information and Streamlit experts.
