anchor.diff:      <input type="hidden" id="uMediaType" name="mediaType" value="<%=mediaType%>"/>
       <input type="hidden" id="uDescription" name="description" value="<%=description%>"/>
       <input type="hidden" id="uResourceName" name="filename" value="<%=resourceName%>"/>
  -    <input type="hidden" id="uRedirect" name="redirect" value="resources/resource.jsp?region=region3&item=resource_browser_menu&path=<%=path.replaceAll("&","%26")%>&viewType=std"/>
  +    <input type="hidden" id="uRedirect" name="redirect" value="resources/resource.jsp?region=region3&item=resource_browser_menu&path=<%=Encode.forHtml(path.replaceAll("&","%26"))%>&viewType=std"/>
       <%
           if ("application/wsdl+xml".equals(mediaType) || "application/x-xsd+xml".equals(mediaType) || "application/policy+xml".equals(mediaType)) {
               %><input type="hidden" id="uSymlinkLocation" name="symlinkLocation" value="<%=parentPath%>"/><%
  
positive.code: <%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
  <%@ taglib uri="http://www.owasp.org/index.php/Category:OWASP_CSRFGuard_Project/Owasp.CsrfGuard.tld" prefix="csrf" %>
  
  <%@ page import="org.wso2.carbon.registry.resource.ui.clients.ResourceServiceClient" %>
  <%@ page import="org.wso2.carbon.utils.ServerConstants" %>
  <%@ page import="org.wso2.carbon.registry.core.utils.RegistryUtils" %>
  
negative.code:         String cookie = (String) session.getAttribute(ServerConstants.ADMIN_SERVICE_COOKIE);
  
          String path = request.getParameter("path");
          String parentPath = Encode.forHtml(RegistryUtils.getParentPath(path));
          String resourceName = Encode.forHtml(RegistryUtils.getResourceName(path));
          String mediaType;
          String description;
          try {
  