Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the following examples, is it necessary to apply HTMLENCODE?

{!$Label.Select_Your_Language} : Custom label 
{!lang.Name}  : SF Custom Object 
{!HotelConfig.languages} : apex class Variable 
{!uNights} : apex class Variable 


<apex:define name="langs-list">
        <apex:repeat value="{!HotelConfig.languages}" var="lang">
            <li class="{!IF(,'selected','')}"><a href="dhotel__t_home?l={!lang.Name}">{!lang.Title__c}</a></li>

<apex:outputPanel id="htnights">
       <input type="text" id="nights" readonly="true" value="{!uNights}"/>
    <apex:inputHidden id="nightsHidden" value="{!uNights}"/>
share|improve this question
You can format code blocks in your question by selecting the text and using the pre-formatted button. – Daniel Ballinger Dec 13 '12 at 19:09
up vote 6 down vote accepted

There are a number of good worked examples on preventing XSS vulnerabilities in the Secure Coding Cross Site Scripting: S-Control Template and Formula Tags developer force article. The examples include when you should use HTMLEncode versus URLENCODE, JSINHTMLENCODE etc... See Encoding Functions.

  • Custom label: <h3>{!$Label.Select_Your_Language}</h3>
    Yes, I'd apply HTMLEncode here unless you specifically want to allow those with permissions to set the label to include HTML characters.
  • SF Custom Object Name in hyperlink: <a href="dhotel__t_home?l={!lang.Name}">
    Yes, I'd apply URLENCODE here
  • Apex class variable: <apex:repeat value="{!HotelConfig.languages}" var="lang">
    Here the value will never be directly rendered to the client so it shouldn't be an issue.
  • Apex class Variable: <input type="text" id="nights" readonly="true" value="{!uNights}"/>
    It depends on how uNights is being set. If in any way the value could have been defined by the user than I would HTMLEncode it. If you have complete control of the value with no user input included then you don't need to.
  • Apex class Variable: <apex:inputHidden id="nightsHidden" value="{!uNights}"/>
    With other apex controls like apex:outputText the value will be encoded by default and if you want the unencoded value you must explicitly set escape="false". apex:inputHidden doesn't have the corresponding attribute so I suspect it is always encoded.
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.