anchor.diff:  				int i = 1;
   				for (FederatedAuthenticatorConfig fedAuth : idp.getFederatedAuthenticatorConfigs()){
   					if (i==idp.getFederatedAuthenticatorConfigs().length){
  -						fedAuthenticatorDisplayType.append(fedAuth.getDisplayName());
  -						fedAuthenticatorType.append(fedAuth.getName());
  +						fedAuthenticatorDisplayType.append(Encode.forHtmlContent(fedAuth.getDisplayName()));
  +						fedAuthenticatorType.append(Encode.forHtmlContent(fedAuth.getName()));
   					}else{
  -						fedAuthenticatorDisplayType.append(fedAuth.getDisplayName() +",");
  -						fedAuthenticatorType.append(fedAuth.getName()+",");
  +						fedAuthenticatorDisplayType.append(Encode.forHtmlContent(fedAuth.getDisplayName() + ","));
  +						fedAuthenticatorType.append(Encode.forHtmlContent(fedAuth.getName() + ","));
   					}
   					
  -					fedAuthType.append(startOption + fedAuth.getName() + middleOption + fedAuth.getDisplayName() + endOPtion);
  +					fedAuthType.append(startOption + Encode.forHtmlAttribute(fedAuth.getName()) + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName()) + endOPtion);
   					if(fedAuth.getEnabled()){
  -						enabledfedAuthType.append(startOption + fedAuth.getName() + middleOption + fedAuth.getDisplayName() + endOPtion);
  +						enabledfedAuthType.append(startOption + Encode.forHtmlAttribute(fedAuth.getName()) + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName()) + endOPtion);
   					}
   					idpAuthenticatorsStatus.put(idp.getIdentityProviderName()+"_"+fedAuth.getName(), fedAuth.getEnabled());
   					i++;
   				}
   				
  -				idpAuthenticators.put(idp.getIdentityProviderName(), fedAuthType.toString());
  -				enabledIdpAuthenticators.put(idp.getIdentityProviderName(), enabledfedAuthType.toString());
  +				idpAuthenticators.put(idp.getIdentityProviderName(), Encode.forHtmlContent(fedAuthType.toString()));
  +				enabledIdpAuthenticators.put(idp.getIdentityProviderName(), Encode.forHtmlContent(enabledfedAuthType.toString()));
   				
  -				idpType.append(startOption + idp.getIdentityProviderName() + "\" data=\""+fedAuthenticatorDisplayType.toString() + "\""+ " data-values=\""+fedAuthenticatorType.toString() + "\" >" + idp.getIdentityProviderName() + endOPtion);
  +				idpType.append(startOption + Encode.forHtmlAttribute(idp.getIdentityProviderName()) + "\" data=\""+ Encode.forHtmlAttribute(fedAuthenticatorDisplayType.toString()) + "\""+ " data-values=\""+ Encode.forHtmlAttribute(fedAuthenticatorType.toString()) + "\" >" + Encode.forHtmlContent(idp.getIdentityProviderName()) + endOPtion);
   				if(idp.getEnable() && enabledfedAuthType.length() > 0){
  -					enabledIdpType.append(startOption + idp.getIdentityProviderName() + "\" data=\""+fedAuthenticatorDisplayType.toString() + "\""+ " data-values=\""+fedAuthenticatorType.toString() + "\" >" + idp.getIdentityProviderName() + endOPtion);
  +					enabledIdpType.append(startOption + Encode.forHtmlAttribute(idp.getIdentityProviderName()) + "\" data=\""+ Encode.forHtmlAttribute(fedAuthenticatorDisplayType.toString()) + "\""+ " data-values=\""+ Encode.forHtmlAttribute(fedAuthenticatorType.toString()) + "\" >" + Encode.forHtmlContent(idp.getIdentityProviderName()) + endOPtion);
   				}
   			} 
   		}
  
positive.code: 					FederatedAuthenticatorConfig fedAuth = idp.getDefaultAuthenticatorConfig();
  					String options = idpAuthenticators.get(idp.getIdentityProviderName());
  					if (fedAuth != null && options != null) {
  						String authName = fedAuth.getName();
  						String oldOption = startOption + fedAuth.getName() + middleOption + fedAuth.getDisplayName() + endOPtion;
  						String newOption = startOption + fedAuth.getName() + "\" selected=\"selected" + middleOption + fedAuth.getDisplayName()+ ((idpAuthenticatorsStatus.get(idp.getIdentityProviderName()+"_"+fedAuth.getName()) != null && idpAuthenticatorsStatus.get(idp.getIdentityProviderName()+"_"+fedAuth.getName()))  ? "" : disbleText) + endOPtion;
  						if(options.contains(oldOption)){
  							options = options.replace(oldOption, newOption);
  						} else {
  
negative.code: 							             	<tr>
  							             		<td>
  							             			<select name="step_<%=step.getStepOrder()%>_local_oauth_select"  style="float: left; min-width: 150px;font-size:13px;">
  							             				<%=localAuthTypes.toString()%>
  							             			</select>
  							             			<a id="claimMappingAddLinkss" onclick="addLocalRow(this,'<%=step.getStepOrder()%>');return false;" class="icon-link claimMappingAddLinkssLocal" style="background-image:url(images/add.gif);">Add Authenticator
  							             			</a>
  