anchor.diff:  				return false;
   			}
   		</cfscript>
  -		
  -	</cffunction>
  -	
  +
  +	</cffunction>
  +
   	<cffunction access="public" returntype="String" name="getValidListItem" output="false"
   	            hint="Returns the list item that exactly matches the canonicalized input. Invalid or non-matching input will generate a descriptive ValidationException, and input that is clearly an attack will generate a descriptive IntrusionException.">
   		<cfargument required="true" type="String" name="context"/>
   		<cfargument required="true" type="String" name="input"/>
   		<cfargument required="true" type="Array" name="list"/>
   		<cfargument type="org.owasp.esapi.ValidationErrorList" name="errorList"/>
  -	
  +
   		<cfscript>
   			if(structKeyExists(arguments, "errorList")) {
   				try {
  
positive.code: 				}
  			}
  		</cfscript>
  		
  	</cffunction>
  	
  	<cffunction access="public" returntype="boolean" name="isValidListItem" output="false"
  	            hint="Returns true if input is a valid list item.">
  		<cfargument required="true" type="String" name="context"/>
  		<cfargument required="true" type="String" name="input"/>
  		<cfargument required="true" type="Array" name="list"/>
  	
  		<cfscript>
  			try {
  				getValidListItem(arguments.context, arguments.input, arguments.list);
  
negative.code: 				}
  			}
  		</cfscript>
  
  	</cffunction>
  
  	<cffunction access="public" returntype="boolean" name="isValidSafeHTML" output="false"
  	            hint="Returns true if input is 'safe' HTML. Implementors should reference the OWASP AntiSamy project for ideas on how to do HTML validation in a whitelist way, as this is an extremely difficult problem.">
  		<cfargument required="true" type="String" name="context"/>
  		<cfargument required="true" type="String" name="input"/>
  		<cfargument required="true" type="numeric" name="maxLength"/>
  		<cfargument required="true" type="boolean" name="allowNull"/>
  
  		<cfscript>
  			// CF8 requires 'var' at the top
  			var loader = "";
  			var ins = "";
  			var as = "";
  			var test = "";
  
  			try {
  				if(!isObject(variables.antiSamyPolicy)) {
  					if(variables.ESAPI.securityConfiguration().getResourceDirectory() == "") {
  
  						//load via classpath
  						loader = getClass().getClassLoader();
  
  						ins = "";
  						try {
  							ins = loader.getResourceAsStream("antisamy-esapi.xml");
  