Here is my requirement. in my visual force page i'm getting stored xss error in escape="false".

<apex:outputText value="{!wrk.html_description__c}" escape="false"> </apex:outputText>
  • Is html_description__c a text field, or rich text field?
    – sfdcfox
    Aug 20, 2014 at 6:30

1 Answer 1


If you are using tag with attribute “escape = false” then please make sure either The value being printed is some fixed non user inputted text like

<apex:outputText escape="false" value="{!"<!DOCTYPE html>"}"/>

Else, value is being escaped via Apex etc using Security Coding Library escape functions or any other equivalent. For ex.

String usertext = ApexPages.currentPage().getParameters().get('usertext');
// the next line encodes the usertext similar to the VisualForce HTMLENCODE function but within an Apex class.
usertext = ESAPI.encoder().SFDC_HTMLENCODE(usertext);

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.