Ok, say for example the output we need on the page must include HTML tags and we want to avoid any security risks.....
Scenerio 1: No user input, string is completely generated by apex code and displayed by the page. - Is there any risk, if so what is the best way to avoid
Scenerio 2: String is constructed in a way that user input is added to the string. The input has
.escapeHTML4() applied. - The obvious risks are Injection and XSS but those would appear to be negated by the applied methods. What if any additional risks are present?
Keep in mind that the application needs the output of the string to contain the HTML elements the apex code adds so it will not be an option to set
This question is both a learning question and a best practice question as this is one of the most frequent reasons apps fail security review.