Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

The description said the option allows user to determine whether to escape the Apex method’s response.

And, actually, it doesn't "escape" the respone, but "encode" or "not encode" the response.

Am I right?

When the remote action like this:

WebService static string showmsg(){
    return '<script>alert(\'Hello\')</script>';

With escape:false

showMsg() is <script>alert('Hello')</script>

With escape:true

showMsg() is &lt;script&gt;alert('Hello')&lt;/script&gt;

Just try difference characters, and find actually it only encode " => &QUOT; and < => &lt; and > => &rt;

And, it DOESN'T encode the two escape characters : ' and \

share|improve this question
up vote 9 down vote accepted

Yep. It is handling XML escape characters (& " < >), not JavaScript. But really, most non-trival applications will use escape: false and a client-side template system to do any escaping.

The default escape: true value is just a safety net to prevent XML code being dumped into the page inadvertently, for trivial applications which fail to escape their output.

Salesforce are pushing the escaping behaviour up into the transport layer by default. While it's not the right place, it's in the spirit of preventing unaware developers from leaving themselves vulnerable to client-side code injection (eg).

It's completely reasonable to have XML characters in the data (eg Grand Hotels & Resorts Ltd), and very standard front-end development practise to escape those XML characters before dumping output onto the page. Just not on the transport!

Obviously the Salesforce default behaviour will cause side effects if one intends to send XML tags around, eg via Rich Long Text fields, or any crazy server-side templating happening in a controller.

share|improve this answer
There're five XML escape characters, however escape:true only encode four of them. ' is not encoded ?? Ref (1) ; Ref (2)… – Cray Kao Jan 31 '14 at 13:39
Is &apos a may be and not a must be in the spec? @CrayKao – bigassforce Jan 31 '14 at 13:46

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.