Cross-Site Scripting: encodeForHTML for HTML content (The OWASP Enterprise Security API) <p>I have a HTML select Tag in my JSP</p> <pre><code>&lt;%@ taglib prefix="esapi" uri="http://www.owasp.org/index.php/Category:OWASP_Enterprise_Security_API"%&gt; &lt;select&gt; ... &lt;option value="volvo"&gt;${device.name}&lt;/option&gt; .... &lt;/select&gt; </code></pre> <p>I set this as device name in the DB</p> <pre><code>"&gt;&lt;script&gt;alert(1)&lt;/script&gt;2d65 </code></pre> <p>I've tried to get rid of the alert when I load the page using</p> <pre><code>&lt;esapi:encodeForHTMLAttribute&gt;${device.name}&lt;/esapi:encodeForHTMLAttribute&gt; </code></pre> <p>or</p> <pre><code>&lt;esapi:encodeForHTML&gt;${device.name}&lt;/esapi:encodeForHTML&gt; </code></pre> <p>or</p> <pre><code>&lt;c : out value="${device.name}"/&gt; </code></pre> <p>or</p> <pre><code> &lt;esapi:encodeForJavaScript&gt;${device.name}&lt;/esapi:encodeForJavaScript&gt; </code></pre> <p>But there is no way ! The alert message always appears when loading the page !</p> <p>In fact, I see that the characters are escaped, but even that an alert appears in the JSP</p> <p><a href="https://i.stack.imgur.com/B0qTY.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/B0qTY.png" alt="enter image description here"></a></p>