Below is the example code for this issue

<apex:OutputText value="{!question.selectedVal}" escape="false"/>

We cannot remove the escape false because we need to show the HTML content. How to pass security review for this code?

1 Answer 1


In order to resolve this issue you will need to change the code as below

<apex:OutputText value="{!question.selectedVal}" escape="false"/>


<apex:outputPanel id="richtextelement"/>
<script>var richtextelement = document.getElementById('{!$Component.richtextelement}'); $(richtextelement).html($('<div/>').html('{!JSENCODE(question.selectedVal)}').html());</script>
  • You will need to include jquery refresh to work this code. Nov 16, 2017 at 10:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .