anchor.diff:                              <td id="id_pattern_category" class="leftCol-big" style="padding-right: 0 !important;"><fmt:message key="list.users"/></td>
                               <td>
                                   <input id="id_filter" type="text" name="<%=UserAdminUIConstants.USER_LIST_FILTER%>"
  -                                       value="<%=filter%>"/>
  +                                       value="<%=Encode.forHtmlAttribute(filter)%>"/>
   
                                   <input id="id_search_button" onclick="search();" class="button" type="button"
                                          value="<fmt:message key="user.search"/>"/>
  
positive.code:     if (claimUri == null || claimUri.length() == 0) {
          claimUri = (java.lang.String) session.getAttribute(UserAdminUIConstants.USER_CLAIM_FILTER);
      }
      session.setAttribute(UserAdminUIConstants.USER_CLAIM_FILTER,claimUri);
      exceededDomains = (FlaggedName) session.getAttribute(UserAdminUIConstants.USER_LIST_CACHE_EXCEEDED);
  
      //  search filter
      String selectedDomain = request.getParameter("domain");
      if(selectedDomain == null || selectedDomain.trim().length() == 0){
          selectedDomain = (String) session.getAttribute(UserAdminUIConstants.USER_LIST_DOMAIN_FILTER);
          if (selectedDomain == null || selectedDomain.trim().length() == 0) {
              selectedDomain = UserAdminUIConstants.ALL_DOMAINS;
  
negative.code:         }
      }
  
      if (userRealmInfo != null) {
          domainNames = userRealmInfo.getDomainNames();
          if (domainNames != null) {
              List<String> list = new ArrayList<String>(Arrays.asList(domainNames));
              list.add(UserAdminUIConstants.ALL_DOMAINS);
              domainNames = list.toArray(new String[list.size()]);
  