anchor.diff:              <tr>
                   <td class="leftCol-big"><fmt:message key="search.label"/></td>
                   <td>
  -                    <input type="text" id="search" value="<%=searchTerm%>"/>
  +                    <input type="text" id="search" value="<%=Encode.forHtml(searchTerm)%>"/>
                       <input id="searchButton" class="button" type="button" onclick="searchRole()" value="Search"/>
                   </td>
               </tr>
  
positive.code:                                           page="topic_add.jsp" pageNumberParameterName="pageNumber"
                                            resourceBundle="org.wso2.carbon.event.ui.i18n.Resources"
                                            prevKey="prev" nextKey="next"
                                            parameters="<%=concatenatedParams%>"/>
                      </div>
                  </td>
              </tr>
  
negative.code: <%@ page import="org.wso2.carbon.ui.CarbonUIUtil" %>
  <%@ page import="java.util.ArrayList" %>
  <%@ page import="java.util.regex.Pattern" %>
  <%@ page import="org.owasp.encoder.Encode" %>
  <%@ taglib uri="http://wso2.org/projects/carbon/taglibs/carbontags.jar" prefix="carbon" %>
  <%@ taglib prefix="fmt" uri="http://java.sun.com/jsp/jstl/fmt" %>
  
  