anchor.diff:                                  &nbsp;&nbsp;&nbsp;
                                   <fmt:message key="search.policy"/>
                                   <input type="text" name="policySearchString"
  -                                       value="<%= policySearchString != null? policySearchString :""%>"/>&nbsp;
  +                                       value="<%= policySearchString != null? Encode.forHtmlAttribute(policySearchString) :""%>"/>&nbsp;
                               </nobr>
                           </td>
                           <td style="border:0; !important">
  
positive.code:             <tr>
                  <td width="10px" style="text-align:center; !important">
                      <input type="checkbox" name="policies"
                             value="<%=policies[i].getPolicyId()%>"
                             onclick="resetVars()" class="chkBox" />
                  </td>
  
                  <td>
                      <a href="policy-view.jsp?policyid=<%=policies[i].getPolicyId()%>"><%=policies[i].getPolicyId()%></a>
                  </td>
  
                  <td width="20px" style="text-align:left;">
  
negative.code:                         if (canViewStatus) {
                      %>
                      <a title="<fmt:message key='view'/>"
                         onclick="viewStatus('<%=Encode.forJavaScriptAttribute(policies[i].getPolicyId())%>');return false;"
                         href="#" style="background-image: url(images/view.gif);" class="icon-link">
                          <fmt:message key='view.status'/></a>
                      <%
  