question: public static String checkStringForHtmlStrictNone ( String valueName , String value , List < String > errorMessageList ) { if ( UtilValidate . isEmpty ( value ) ) return value ; try { value = canonicalize ( value , true ) ; } catch ( IntrusionException e ) { Debug . logError ( "Canonicalization (format consistency, character escaping that is mixed or double, etc) error for attribute named [" + valueName + "], String [" + value + "]: " + e . toString ( ) , module ) ; errorMessageList . add ( "In field [" + valueName + "] found character escaping (mixed or double) that is not allowed or other format consistency error: " + e . toString ( ) ) ; } if ( value . indexOf ( "<" ) >= 0 || value . indexOf ( ">" ) >= 0 ) { errorMessageList . add ( "In field [" + valueName + "] less-than (<) and greater-than (>) symbols are not allowed." ) ; } return value ; }
target:  Uses a black-list approach for necessary characters for HTML. Does not allow various characters (after canonicalization), including "<", ">", "&" (if not followed by a space), and "%" (if not followed by a space).