A collection of beginner-friendly HTML writing activities for young web makers.

• Make Your First Website
• Tell a Hypertext Story
• Choose Your Own Adventure
• Make a Web Poem
• Build a Whole Website
• HTML Snippet Board

The activities introduce HTML structure, text, links, images, audio, video, and simple page-to-page navigation. Each builder includes a live preview and produces downloadable HTML.

Live site: https://firstpage.val.run/

• Status: Accepted
• Date: 2026-08-01

The advanced website activity stores each page body as an HTML string. React does not interpret a string as elements by default, so the visual editor and preview use dangerouslySetInnerHTML to turn that string into rendered HTML.

That API is necessary for the current visual editing experience, but unsanitized HTML is an injection sink. A script element inserted through innerHTML normally does not execute, but event attributes such as onerror, dangerous URL schemes such as javascript:, and other active markup can still execute in the application document.

Although projects currently remain in the student's browser, students may paste examples from the web and future versions may support importing or sharing projects. User-authored HTML must therefore be treated as untrusted.

All advanced-page HTML is sanitized with DOMPurify before it:

1. Enters the WYSIWYG editor.
2. Enters the visual preview.
3. Is included in a downloaded website.
4. Is accepted as rich HTML from the clipboard.

The sanitizer uses an allowlist intended for the lesson:

• Elements: headings, paragraphs, emphasis, links, images, lists, blockquotes, and line breaks.
• Attributes: href, src, alt, and title.

Scripts, event-handler attributes, embeds, styles, data attributes, ARIA attributes, and unsupported elements are removed. Toolbar-created web links and image URLs must use http:// or https://. Internal page links continue to use controlled relative filenames.

Raw text may still be written in HTML mode so students can see and correct their source, but only sanitized output is rendered or downloaded.

• Student-authored HTML cannot execute JavaScript in the main First Page application through the supported editor flow.
• Pasting formatted text continues to work, but unsupported formatting is removed.
• Advanced users cannot add scripts, iframes, custom CSS, forms, or arbitrary attributes in this activity.
• Adding a new supported HTML feature requires deliberately expanding the sanitizer allowlist.
• Sanitization is the primary control. A sandboxed preview iframe and a strict Content Security Policy remain recommended defense-in-depth improvements.