String searchTerm = request.getParameter("searchTerm");
log.debug("User Submitted - " + searchTerm);
searchTerm = XssFilter.levelTwo(searchTerm);
log.debug("After Filtering - " + searchTerm);
String htmlOutput = new String();
<BUG>String applicationRoot = getServletContext().getRealPath("");</BUG>
if(FindXSS.search(searchTerm))
{
Encoder encoder = ESAPI.encoder();
<BUG>htmlOutput = "<h2 class='title'>Well Done</h2>" +
"<p>You successfully executed the JavaScript alert command!<br />" +
"The result key for this challenge is <a>" +
encoder.encodeForHTML(</BUG>
Hash.generateUserSolution(

String searchTerm = request.getParameter("searchTerm");
log.debug("User Submitted - " + searchTerm);
searchTerm = XssFilter.levelTwo(searchTerm);
log.debug("After Filtering - " + searchTerm);
String htmlOutput = new String();
if(FindXSS.search(searchTerm))
{
Encoder encoder = ESAPI.encoder();
htmlOutput = "<h2 class='title'>" + bundle.getString("result.wellDone") + "</h2>" +
"<p>" + bundle.getString("result.youDidIt") + "<br />" +
bundle.getString("result.resultKey") + " <a>" +
encoder.encodeForHTML(
Hash.generateUserSolution(
