I have found this issue when I have given my code to Code Scanner

Reflected XSS

This is basically because of two things

    Map<string,string> params =

var validAddress = '{!validAddress}';// it is in VF Page where valid Address is String in apex class

How can I resolve this issue?

  • 1
    those code is not enough to figure out what is that issue
    – kurunve
    Jul 20, 2016 at 7:34
  • 1
    but what can I say from this -- try to use JSENCODE and HTMLENCODE to ensure that there are no JS injected in validAddress variable (salesforce.stackexchange.com/a/61377/18189) as well as using escapeSingleQuotes on page parameters to avoid injection there
    – kurunve
    Jul 20, 2016 at 7:37
  • If it is VF page use: var validAddress = '{!JSENCODE(validAddress)}';
    – Liron C
    Mar 15, 2022 at 7:57

1 Answer 1


The risk that scanner is alerting you to is that a hacker could put malicious code in a URL parameter. The parameter values (and names, I suppose) are data from an outside source, and should not be trusted.
Because of the legitimate risk, you should implement the suggestions from kurunve above: encode and/or escape the parameters as appropriate for the context that you are using them in.

  • We can't tell what relationship (if any) exists between params and validAddress. Certainly the snippet is not enough to assess if a legitimate vulnerability exists.
    – Adrian Larson
    Jul 20, 2016 at 12:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .