Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using JS Remoting I want to generate HTML content in the backend and then display it in the VF page.

I am building the string in the controller as per follows:

String account = [SELECT Id, Name FROM Account LIMIT 1];
String htmlContent = 'This is the string built in APEX <a href="' + account.Id + '" target="_blank">Click here if you want to visit ' + account.Name + '</a>. This is an example';

Now, when I debug the string in Firebug onto the page, it comes encoded as per follows:

This is the string built in APEX &lt;a href=&quot' + account.Id + '&quot target=&quot_blank&quot&gt;Click here if you want to visit ' + account.Name + '&lt;/a&gt;. This is an example

Which is fine and I understand Salesforce does it for security reasons.

Before I jumped into the proper solution, which is passing the ID and the NAME only, and then build the string in JS, I though I'd give it a go with replacing the encoded string with JS functions. And I did so:

function getString(param1)
    ClassName.Method(param1, function(result, event) 
        if(event.type === 'exception') 
            return false;
        else if(result)
            console.log(result.message.replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&quot;/g, '"'));
            // do something....

In the console I still get the same result, < and > are not replaced with < and > accordingly.

Then I ran the same code in pure HTML + JS, and it works.

Next thing I tried was logging indexOf('&lt;') and it returned -1. However, indexOf('lt;') and indexOf('&') both returned the correct position in the string.

Does anyone know WHY this doesn't work in VF?

share|improve this question
Have you tried binding to apex:outputText with escape=false – techtrekker Jan 2 '13 at 8:12
Not sure if binding will work for him since he is calling this method from a remote action. It's not a bound variable from a controller. – Kevin O'Hara Jan 2 '13 at 19:32
The one thing that I know is that Visualforce isn't causing the issue here. If you are just using remote actions, then Visualforce has already done it's job and the only things in play are your browser and the server response to your remote action call. Based on what you have described, this should be working for you. Can you post your firebug output? Can you try looking at it in Chrome? – Kevin O'Hara Jan 2 '13 at 19:42
up vote 9 down vote accepted

I honestly can't figure out why you aren't able to decode this on the client side based on what you have written, but one solution to fix this would be to specify the escape:false configuration in the remote action call. From the remote action docs:

  • configuration configures the handling of the remote call and response. Use this to specify whether or not to escape the Apex method’s response. The default value is {escape: true}.

Here is what this would look like:

    function(result, event){
share|improve this answer
That's the bugger, how could I miss it? :) Thanks @kevin – Boris Bachovski Jan 3 '13 at 4:56
... and good that it is also available in the more convenient controller.method way of invoking the remote action. – Keith C Feb 21 '14 at 17:01
escape:false is an awesome fix for the problem, however we need to remember that displaying user input un-escaped can have security risks -… Just need to double check what gets output etc. – Joshua Dance Aug 12 '14 at 20:15

You are close. There are two main issues.

1) The html you will want to use returned from the remoting is result not result.message

2) You will need to decode the returned html.

Below is a working example.


public class StackExchangeController {

  public static String getHtml() {
    Account account = [SELECT Id, Name FROM Account LIMIT 1];
    return 'This is the string built in APEX <a href="' + account.Id + '" target="_blank">Click here if you want to visit ' + account.Name + '</a>. This is an example';        



<apex:page controller="StackExchangeController" sidebar="false" showHeader="false" standardStylesheets="false">
    <script src="{!URLFOR($Resource.jquery, 'jquery/jquery-1.8.2.min.js')}" >
      $(document).ready(function() {
        StackExchangeController.getHtml(function(result, event) {
          //$('<div />').html(string).text() is a simple way of decoding html with jquery
          result = $('<div />').html(result).text();
    <div id="target"></div>

share|improve this answer
Forgot to mention that I'm using a wrapper class to return the result. result.message is the correct string. – Boris Bachovski Jan 3 '13 at 4:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.