Take the 2-minute tour ×
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It's 100% free, no registration required.

The CheckMarx security scanner says that the 4th line:

$j('#h{!category}').on('click', function(event) {

in the following script, causes an XSS vulnerability. Can someone explain the best way to fix it? or if it's a false positive, how can I rewrite the script so it does not happen?

<script type="text/javascript" charset="UTF-8">
        $j = jQuery.noConflict();
        $j('#h{!category}').on('click', function(event) {        
            $j('#lmenu').on('mouseout', function(event) {        
            $j('#s{!category}').on('mouseover', function(event) {        


share|improve this question

1 Answer 1

up vote 4 down vote accepted

I believe its because you are using an unescaped output in your JS


. Instead use the JSENCODE formula


for further details see

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.