I have an apex apex:outputtext used in VF page with escape="true". Setting escape = true shows the html entities instead of displaying the required html format. As the code is in managed package this should be XSS free using either escape=true or using HTMLENCODE VF function. Making XSS free makes the field to show the html entities. For example


String htmlString = '<p>Hello World</p>';

VF Page:

<apex:outputtext escape="true" value="{!htmlString }"/>

or just:

{!HTMLENCODE(htmlString )} 

will give the output:

&lt;p&gt;Hello World&lt;p&gt;

Expected result is <p>Hello World</p>. So how to get this output with XSS fix?

  • Strange but i can't reproduce it at my dev org. Could you post more VF code? Dec 4, 2013 at 8:15
  • I can't reproduce it either. The outputtext tag renders your expected result but in quotes and the HTMLENCODE expression generates the output using HTML entities. Which API version are your page / controller defined in?
    – FrankZ
    Dec 4, 2013 at 8:49

2 Answers 2


Thinking about it, you will never be able to use the escape="true" attribute to achieve what you want. You want your generated HTML to be rendered by the browser so you have to use escape="false"

That means you have to sanitize your HTML in the controller prior to it being rendered by your VF page. Which means you need to think about what you want to allow to pass that sanitization and what may not pass.

There's some good information about the topic on the OWASP web site and some more Salesforce specific stuff on developerforce. Looks like what you really need is an APEX version of the antisamy library.

I don't know of such a project, though others have used a web service to achieve the sanitization outside of the Salesforce environment. Surely not what you look for.

A Salesforce version of OWASPs ESAPI library has been published by Salesforce itself. That might help but unfortunately is no replacement for AntiSamy.

  • 3
    Really this is more of a design problem. If you need to display arbitrary user-input HTML, and aren't using the in-built rich text fields (which sanitize for you! and render properly with escape="true") you need to back up a step and redesign. Dec 5, 2013 at 3:09

This is not a design problem. This can be very useful for testing and development, as well as giving people code. There is no use building something or using another engine for simple tests.

Try this. <pre lang="HTML">{!htmlString }</pre>

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .