title: OWASP ZAP Fuzzing- Input parameter is reflected back in response as a string, still XSS?
body: <p>The original issue is here:
  http://stackoverflow.com/questions/29223275/owasp-zap-reported-alert1-xss-vulnerability-but-no-popup-showed-up</p>
  
  <p>Our developer fixed the issue by using HttpUtility.JavaScriptStringEncode to encode strings in javascript. After we used OWASP ZAP to fuzz the parameter, we still got several (Reflected) yellow balls in the result list. Clicked the item in yellow ball, the highlight in response was, for example: </p>
  
  <p>DataSet.FilterBuilder.QueryValuesDictionary['57_ctl00'] = "alert(1)"; </p>
  
  <p>As you can see, attacked code is just a simple string and not be executed. Could we say we are safe now and this is just a false positive? </p>