How to prevent DOM XSS Vulnerability for this script -

Question

{!tableData} is Server variable.

<script> 
$('.content').html("{!tableData}"); ... 
</script>

"{!tableData}" is having HTML data.

Answer 1

You will need to encode using JSENCODE and HTMLENCODE .

Here is what you can do

<script type="text/javascript"> 
  $('.content').html("{!JSINHTMLENCODE(tableData)}"); ... 
</script>