anchor.diff:      boolean showProfileData = "true".equalsIgnoreCase(request.getParameter("show_profile_data"));
   
       String msgs = request.getParameter("msg");
  -    if (msgs!=null) {
  -        msgs = StringEscapeUtils.escapeJavaScript(msgs);
  -    }
  +//    if (msgs!=null) {
  +//        msgs = StringEscapeUtils.escapeJavaScript(msgs);
  +//    }
   %>
   
   <script type="text/javascript">
  
positive.code: <%@ page import="org.apache.commons.lang.StringEscapeUtils" %>
  <%@ page import="org.apache.commons.fileupload.FileItem" %>
  <%@ page import="org.apache.commons.codec.binary.Base64" %>
  <html>
  <body>
  
  
negative.code: 
  if (format!=null) {
      graphml = request.getParameter("graphml");
  
  	if (request instanceof XssRequestWrapper)
  	{
  		graphml = ((XssRequestWrapper)request).getRawParameter("graphml");
  	}
  
      if (graphml!=null&&!graphml.isEmpty()) {
          if (!format.equalsIgnoreCase("graphml")) {
              try {
  