title: Cross-Site Scripting: encodeForHTML for HTML content (The OWASP Enterprise Security API)
body: <p>I have a HTML select Tag in my JSP</p>
  
  <pre><code>&lt;%@ taglib prefix="esapi"   uri="http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API"%&gt;
  
      &lt;select&gt;
         ...
        &lt;option value="volvo"&gt;${device.name}&lt;/option&gt;
        ....
      &lt;/select&gt;
  </code></pre>
  
  <p>I set this as device name in the DB</p>
  
  <pre><code>"&gt;&lt;script&gt;alert(1)&lt;/script&gt;2d65
  </code></pre>
  
  <p>I've tried to get rid of the alert when I load the page using</p>
  
  <pre><code>&lt;esapi:encodeForHTMLAttribute&gt;${device.name}&lt;/esapi:encodeForHTMLAttribute&gt;
  </code></pre>
  
  <p>or</p>
  
  <pre><code>&lt;esapi:encodeForHTML&gt;${device.name}&lt;/esapi:encodeForHTML&gt;
  </code></pre>
  
  <p>or</p>
  
  <pre><code>&lt;c : out value="${device.name}"/&gt;
  </code></pre>
  
  <p>or</p>
  
  <pre><code> &lt;esapi:encodeForJavaScript&gt;${device.name}&lt;/esapi:encodeForJavaScript&gt;
  </code></pre>
  
  <p>But there is no way ! The alert message always appears when loading the page !</p>
  
  <p>In fact, I see that the characters are escaped, but even that an alert appears in the JSP</p>
  
  <p><a href="https://i.stack.imgur.com/B0qTY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/B0qTY.png" alt="enter image description here"></a></p>