anchor.diff:  				int i = 1;
   				for (FederatedAuthenticatorConfig fedAuth : idp.getFederatedAuthenticatorConfigs()){
   					if (i==idp.getFederatedAuthenticatorConfigs().length){
  -						fedAuthenticatorDisplayType.append(fedAuth.getDisplayName());
  -						fedAuthenticatorType.append(fedAuth.getName());
  +						fedAuthenticatorDisplayType.append(Encode.forHtmlContent(fedAuth.getDisplayName()));
  +						fedAuthenticatorType.append(Encode.forHtmlContent(fedAuth.getName()));
   					}else{
  -						fedAuthenticatorDisplayType.append(fedAuth.getDisplayName() +",");
  -						fedAuthenticatorType.append(fedAuth.getName()+",");
  +						fedAuthenticatorDisplayType.append(Encode.forHtmlContent(fedAuth.getDisplayName() + ","));
  +						fedAuthenticatorType.append(Encode.forHtmlContent(fedAuth.getName() + ","));
   					}
   					
  -					fedAuthType.append(startOption + fedAuth.getName() + middleOption + fedAuth.getDisplayName() + endOPtion);
  +					fedAuthType.append(startOption + Encode.forHtmlAttribute(fedAuth.getName()) + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName()) + endOPtion);
   					if(fedAuth.getEnabled()){
  -						enabledfedAuthType.append(startOption + fedAuth.getName() + middleOption + fedAuth.getDisplayName() + endOPtion);
  +						enabledfedAuthType.append(startOption + Encode.forHtmlAttribute(fedAuth.getName()) + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName()) + endOPtion);
   					}
   					idpAuthenticatorsStatus.put(idp.getIdentityProviderName()+"_"+fedAuth.getName(), fedAuth.getEnabled());
   					i++;
   				}
   				
  -				idpAuthenticators.put(idp.getIdentityProviderName(), fedAuthType.toString());
  -				enabledIdpAuthenticators.put(idp.getIdentityProviderName(), enabledfedAuthType.toString());
  +				idpAuthenticators.put(idp.getIdentityProviderName(), Encode.forHtmlContent(fedAuthType.toString()));
  +				enabledIdpAuthenticators.put(idp.getIdentityProviderName(), Encode.forHtmlContent(enabledfedAuthType.toString()));
   				
  -				idpType.append(startOption + idp.getIdentityProviderName() + "\" data=\""+fedAuthenticatorDisplayType.toString() + "\""+ " data-values=\""+fedAuthenticatorType.toString() + "\" >" + idp.getIdentityProviderName() + endOPtion);
  +				idpType.append(startOption + Encode.forHtmlAttribute(idp.getIdentityProviderName()) + "\" data=\""+ Encode.forHtmlAttribute(fedAuthenticatorDisplayType.toString()) + "\""+ " data-values=\""+ Encode.forHtmlAttribute(fedAuthenticatorType.toString()) + "\" >" + Encode.forHtmlContent(idp.getIdentityProviderName()) + endOPtion);
   				if(idp.getEnable() && enabledfedAuthType.length() > 0){
  -					enabledIdpType.append(startOption + idp.getIdentityProviderName() + "\" data=\""+fedAuthenticatorDisplayType.toString() + "\""+ " data-values=\""+fedAuthenticatorType.toString() + "\" >" + idp.getIdentityProviderName() + endOPtion);
  +					enabledIdpType.append(startOption + Encode.forHtmlAttribute(idp.getIdentityProviderName()) + "\" data=\""+ Encode.forHtmlAttribute(fedAuthenticatorDisplayType.toString()) + "\""+ " data-values=\""+ Encode.forHtmlAttribute(fedAuthenticatorType.toString()) + "\" >" + Encode.forHtmlContent(idp.getIdentityProviderName()) + endOPtion);
   				}
   			} 
   		}
  
positive.code:         })
          jQuery('#stepsAddLink').click(function(){
          	stepOrder++;
          	jQuery('#stepsConfRow').append(jQuery('<h2 id="step_head_'+stepOrder+'" class="sectionSeperator trigger active step_heads" style="background-color: beige; clear: both;"><input type="hidden" value="'+stepOrder+'" name="auth_step" id="auth_step"><a class="step_order_header" href="#">Step '+stepOrder+'</a><a onclick="deleteStep(this);return false;" href="#" class="icon-link" style="background-image: url(images/delete.gif);float:right;width: 9px;"></a></h2><div class="toggle_container sectionSub step_contents" style="margin-bottom:10px;" id="step_dev_'+stepOrder+'"> <div style="padding-bottom: 5px"><table class="carbonFormTable"><tr><td><input type="checkbox" style="vertical-align: middle;" id="subject_step_'+stepOrder+'" name="subject_step_'+stepOrder+'" class="subject_steps" onclick="setSubjectStep(this)"><label for="subject_step_'+stepOrder+'" style="cursor: pointer;">Use subject identifier from this step</label></td></tr><tr><td><input type="checkbox" style="vertical-align: middle;" id="attribute_step_'+stepOrder+'" name="attribute_step_'+stepOrder+'" class="attribute_steps" onclick="setAttributeStep(this)" ><label for="attribute_step_'+stepOrder+'" style="cursor: pointer;">Use attributes from this step</label></td></tr></table></div><h2 id="local_auth_head_'+stepOrder+'" class="sectionSeperator trigger active" style="background-color: floralwhite;"><a href="#">Local Authenticators</a></h2><div class="toggle_container sectionSub" style="margin-bottom:10px;" id="local_auth_head_dev_'+stepOrder+'"><table class="styledLeft" width="100%" id="local_auth_table_'+stepOrder+'"><thead><tr><td><select name="step_'+stepOrder+'_local_oauth_select" style="float: left; min-width: 150px;font-size:13px;"><%=localAuthTypes.toString()%></select><a id="claimMappingAddLinkss" onclick="addLocalRow(this,'+stepOrder+');return false;" class="icon-link claimMappingAddLinkssLocal" style="background-image:url(images/add.gif);">Add Authenticator</a></td></tr></thead></table> </div><%if (enabledIdpType.length() > 0) { %> <h2 id="fed_auth_head_'+stepOrder+'" class="sectionSeperator trigger active" style="background-color: floralwhite;"><a href="#">Federated Authenticators</a></h2><div class="toggle_container sectionSub" style="margin-bottom:10px;" id="fed_auth_head_dev_'+stepOrder+'"><table class="styledLeft" width="100%" id="fed_auth_table_'+stepOrder+'"><thead> <tr><td><select name="idpAuthType_'+stepOrder+'" style="float: left; min-width: 150px;font-size:13px;"><%=Encode.forJavaScriptAttribute(Encode.forHtml(enabledIdpType.toString()))%></select><a id="claimMappingAddLinkss" onclick="addIDPRow(this,'+stepOrder+');return false;" class="icon-link claimMappingAddLinkssIdp" style="background-image:url(images/add.gif);">Add Authenticator</a></td></tr></thead></table></div><%}%></div>'));
          	if(!$('#stepsConfRow').is(":visible")){
                  $(jQuery('#stepsConfRow')).toggle();
              }
  
negative.code: 						stepIdpAuthenticators.put(step.getStepOrder()+"_"+idp.getIdentityProviderName(), options);
  					} else if (fedAuth != null && options == null) {
  						// All Federated Authenticators are disabled. But saved one is available
  						String disabledOption = startOption + Encode.forHtmlAttribute(fedAuth.getName()) + "\" selected=\"selected" + middleOption + Encode.forHtmlContent(fedAuth.getDisplayName())+ disbleText + endOPtion;
  						stepIdpAuthenticators.put(step.getStepOrder()+"_"+idp.getIdentityProviderName(), disabledOption);
  					} else {
  						// No saved Federated Authenticators
  