anchor.diff:  <%@ page import="org.apache.commons.lang.StringEscapeUtils" %>
   <%@ page import="org.apache.commons.fileupload.FileItem" %>
   <%@ page import="org.apache.commons.codec.binary.Base64" %>
  +<%@ page import="org.mskcc.cbio.portal.util.XssRequestWrapper" %>
  +
   <html>
   <body>
   
  
positive.code: 
  if (format!=null) {
      graphml = request.getParameter("graphml");
      if (graphml!=null&&!graphml.isEmpty()) {
          if (!format.equalsIgnoreCase("graphml")) {
              try {
  
negative.code:     boolean showProfileData = "true".equalsIgnoreCase(request.getParameter("show_profile_data"));
  
      String msgs = request.getParameter("msg");
  //    if (msgs!=null) {
  //        msgs = StringEscapeUtils.escapeJavaScript(msgs);
  //    }
  %>
  
  <script type="text/javascript">
  