Your problem is with angular disinfection. It will not allow you to use ng-bind-html until you paste your HTML content into a special variable marked as robust HTML. angular forces you to do this so that you know that you explicitly tell angular that this markup can be done.
This helps protect the average developer from inadvertently displaying user input, which would be very dangerous. You do not want users to send javascript to the input fields and then show that your application is displaying the script directly on the page somewhere. If this is the case, the malicious script will run during rendering and may cause all kinds of hacks.
You need to enable the ngSanitize module depending on your application.
var app = angular.module('myApp', ['ngSanitize']);
Remember to include angular -sanitize lib in your script links.
<script src="//ajax.googleapis.com/ajax/libs/angularjs/XYZ/angular-sanitize.js"></script>
Then you need to mark your HTML content as safe for rendering using the $sce service.
app.controller('myController', function ($scope, $sce) { $scope.trustedHtml = $sce.trustAsHtml(contentHTML); });
Only then will ng-bind-html work.
<div ng-bind-html="trustedHtml"></div>
Demo: http://codepen.io/Chevex/pen/xGYydr?editors=101
source share