We are implementing the Embedded Chat with SalesForce. I believe it is the Lightning chat and it is currently in "beta" from my understanding.

We have having issues with different coding characters. What is going on is an apostrophe is turning into: & #x27;

I looked into the embedded chat, and it looks like I can hook into various events, but the one that I thought would give me what text will be displayed on the screen only had the session key (https://developer.salesforce.com/docs/atlas.en-us.snapins_web_dev.meta/snapins_web_dev/snapins_web_chat_events.htm).

Is there another way to find out and decode the string without having to do a LOT of jQuery manipulation?

1 Answer 1


Your question doesn't quite provide enough information to answer in a definitive manner, but I'll try to cover most of the bases. At this current time, we (as the reader) do not know without assuming where this character is originating from, how you are obtaining it or what you're trying to do with it. But I can explain why an apostrophe is "turning into" &#x27. Allowing unescaped HTML into a web app's DOM exposes a security risk because unescaped HTML can allow the browser to execute or interpret malicious data collected from a user.

To prevent this security risk is the concept of escaping the special reserved characters--which is the apostrophe (single quote) turning "'" into the hex &#x27 is escaped ensuring that the text content being inserted into the DOM is well-formed and the browser to ignore the special function of characters, and simply display it as text. So whenever we must process untrusted user input for web applications (i.e., ALL input is untrusted), we must filter the input and encode the output to prevent server-side injections or XSS vulnerability. Escaping is also used in many other areas besides web applications to prevent such things as SQL injection.

I'm not sure what you are trying to do with the String that contains the character, but if you're inserting it (using jQuery as mentioned) into the DOM after retrieving it from a server, set the innerHTML to '&#x27' and the browser will render it correctly and encode it to the format specified by the page's charset. Do not set innerText or use any other DOM text methods, you must tell the browser explicitly what you are inserting is to be interpreted as HTML. If you are using a library such as jQuery to do this, be very certain that the API for DOM Html insertion does not call eval()--it defeats the purpose of escaped HTML. If you are retrieving it from somewhere and interested in sending it to your app's server, then I would decode and sanitize it on the server side, otherwise you are exposing another security risk assuming that the data from the user being sent from the client is trusted data being sent to the server. A savvy user will nullify your decoding and sanitization attempts on the client side and send the server some nasty data.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .