title: ESAPI for XSS prevention not working
body: <p>I am working on fixing Cross site scripting issues in our code mainly in JSPS.</p>
  
  <p>Below is the original code</p>
  
  <pre><code> //scriplet code
      &lt;% String userId = request.getParameter("sid"); 
      ...%&gt;
  </code></pre>
  
  <p>and in the same Jsp they have</p>
  
  <pre><code>     &lt;input type = hidden name = "userID" value = "&lt;%= userId %&gt;" /&gt;
  </code></pre>
  
  <p>I have made changes to include esapi-2.1.0.jar in lib and ESAPI.properties, validation.properties in classpath. Then made below changes to scriplet code to fix the above code</p>
  
  <pre><code>      //scriplet code
      &lt;% String userId = ESAPI.encoder().encodeForHTML(request.getParameter("sid")); 
      ...%&gt;
  </code></pre>
  
  <p>I thought this would fix the issue but when I scan my code using Fortify, these lines are again highlighted as having XSS issue. Please help if you guys have any idea on how this should be handled. Thanks.</p>
  
  <p>------- UPDATE</p>
  
  <p>Thanks a lot @avgvstvs. This is very insightful.Follwd guidelines, Not sure if I am missng somethn. Code -</p>
  
  <pre><code>          String              userSID=ESAPI.encoder().encodeForHTMLAttribute(request.getHeader("janus_sid")); session.setAttribute("username",userSID);&lt;input type=hidden name="USERNAME" value="&lt;%= userSID %&gt;"
  </code></pre>
  
  <p>And for another varibale debug, below is the usage </p>
  
  <pre><code>       String debugFlag =  ESAPI.encoder().encodeForJavaScript(request.getParameter("debug"));var debugFlag = "&lt;%= debugFlag%&gt;";if(debugFlag == "y"){       
          document.title=   title + " (" + host + ")";
          defaultAppTitle = title + " (" + host +  ")";           
      }                                                           
  </code></pre>
  
  <p>Latest Fortify scan still lists them as vulnerabilities :-(</p>