anchor.diff:  						stepIdpAuthenticators.put(step.getStepOrder()+"_"+idp.getIdentityProviderName(), options);
   					} else if (fedAuth != null && options == null) {
   						// All Federated Authenticators are disabled. But saved one is available
  -						String disabledOption = startOption + fedAuth.getName() + "\" selected=\"selected" + middleOption + fedAuth.getDisplayName()+ disbleText + endOPtion;
  +						String disabledOption = startOption + Encode.forHtmlAttribute(fedAuth.getName()) + "\" selected=\"selected" + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName())+ disbleText + endOPtion;
   						stepIdpAuthenticators.put(step.getStepOrder()+"_"+idp.getIdentityProviderName(), disabledOption);
   					} else {
   						// No saved Federated Authenticators
  
positive.code: 							             	<tr>
  							             		<td>
  							             			<select name="step_<%=step.getStepOrder()%>_local_oauth_select"  style="float: left; min-width: 150px;font-size:13px;">
  							             				<%=Encode.forHtmlContent(localAuthTypes.toString())%>
  							             			</select>
  							             			<a id="claimMappingAddLinkss" onclick="addLocalRow(this,'<%=step.getStepOrder()%>');return false;" class="icon-link claimMappingAddLinkssLocal" style="background-image:url(images/add.gif);">Add Authenticator
  							             			</a>
  
negative.code: 	
  	if (localAuthenticatorConfigs!=null && localAuthenticatorConfigs.length>0) {
  		for(LocalAuthenticatorConfig auth : localAuthenticatorConfigs) {
  			localAuthTypes.append(startOption + Encode.forHtmlAttribute(auth.getName()) + middleOption + Encode.forHtmlContent(auth.getDisplayName()) + endOPtion);
  		}
  	}
  
  