Here is my requirement. in my visual force page i'm getting stored xss error in escape="false".

<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
  • Is html_description__c a text field, or rich text field?
    – sfdcfox
    Aug 20, 2014 at 6:30

1 Answer 1


If you are using tag with attribute “escape = false” then please make sure either The value being printed is some fixed non user inputted text like

<apex:outputText escape="false" value="{!"<!DOCTYPE html>"}"/>

Else, value is being escaped via Apex etc using Security Coding Library escape functions or any other equivalent. For ex.

String usertext = ApexPages.currentPage().getParameters().get('usertext');
// the next line encodes the usertext similar to the VisualForce HTMLENCODE function but within an Apex class.
usertext = ESAPI.encoder().SFDC_HTMLENCODE(usertext);

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .