title: Preventing Client Potential Code Injection in Javascript
body: <p>I have created an application in java in gae and run it against checkmarx to check for security vulnerabilities and it is throwing error under the heading - Client Potential Code Injection. it shows error at the following line:</p>
  
  <pre><code>var email = $(this).text();
  </code></pre>
  
  <p>Below is that snippet from my code and I am not sure why it is still throwing the error when I am escaping email before using it:</p>
  
  <pre><code>$("#user-modal .user-list li").click(function() {
    $("#user-modal").hide();
    var email = $(this).text();
    var escapedEmail = escapeHtml(email);
    $("input#user").val(escapedEmail);
    loadAllData(email);
  });
  </code></pre>
  
  <p>Here is what loadAllData method does using the passed email value:</p>
  
  <pre><code>function loadAllData(email) {
              $("#user-modal").modal('hide');
              userEmail = email;
              userParam = "";
              if (userEmail) {
                  userParam = "?userEmail=" + userEmail;
              }
              requestGroups("");
              requestAdminRoles("");
              requestOrganizationalUnits("");
  
              // Search
              $("button.refresh-ou").bind("click", function(){
                  var searchString = "/" + $("input.search-ou").val();
                  requestOrganizationalUnits(searchString);
              });
              $("button.refresh-role").bind("click", function() {
                  var searchString = "/" + $("input.search-role").val();
                  requestAdminRoles(searchString);
              });
              $("button.refresh-group").bind("click", function() {
                  var searchString = "/" + $("input.search-group").val();
                  requestGroups(searchString);
              });
          }
  </code></pre>
  
  <p>Can anyone help?</p>