Here is my requirement. in my visual force page i'm getting stored xss error in escape="false".
<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
Salesforce Stack Exchange is a question and answer site for Salesforce administrators, implementation experts, developers and anybody in-between. It only takes a minute to sign up.
Sign up to join this communityHere is my requirement. in my visual force page i'm getting stored xss error in escape="false".
<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
If you are using tag with attribute “escape = false” then please make sure either The value being printed is some fixed non user inputted text like
<apex:outputText escape="false" value="{!"<!DOCTYPE html>"}"/>
Else, value is being escaped via Apex etc using Security Coding Library escape functions or any other equivalent. For ex.
String usertext = ApexPages.currentPage().getParameters().get('usertext');
// the next line encodes the usertext similar to the VisualForce HTMLENCODE function but within an Apex class.
usertext = ESAPI.encoder().SFDC_HTMLENCODE(usertext);