title: Cross Site Scripting Poor Validation ESAPI + JSF Fortify
body: <p>i would like to encode the value attribute using the ESAPI library using the  specific method: ESAPI.encoder().encodeForHTMLAttribute(). My question is should i be using this method in the JSF itself or in the MessageBean? If i were to encode this in the JSF is this the correct syntax? </p>
  
  <pre><code>&lt;h3&gt;&lt;/f:verbatim&gt;&lt;h:outputText id="frsubject" value="#{MessageBean.frSubject}" /&gt;&lt;f:verbatim&gt;&lt;/h3&gt;
  
  &lt;h3&gt;&lt;/f:verbatim&gt;&lt;h:outputText id="frsubject" value=&lt;%= ESAPI.encoder().encodeForHTMLAttribute("#{MessageBean.frSubject}") %&gt; /&gt;&lt;f:verbatim&gt;&lt;/h3&gt;
  </code></pre>
  
  <p>Thansk @BalusC. Sorry for the late response i was also under the impression that with  i would be safe from xss attacks(using JSF 1.2). However in the fortify report the explanation is as below:</p>
  
  <p>The use of certain encoding constructs, such as the  tag with the escapeXml="true" attribute (the default behavior), will
  prevent some, but not all cross-site scripting attacks. Depending on the context in which the data appear, characters beyond the
  basic &lt;, >, &amp;, and " that are HTML-encoded and those beyond &lt;, >, &amp;, ", and ' that are XML-encoded may take on metameaning.
  Relying on such encoding constructs is equivalent to using a weak blacklist to prevent cross-site scripting and might
  allow an attacker to inject malicious code that will be executed in the browser. Because accurately identifying the context in
  which the data appear statically is not always possible, Fortify Static Code Analyzer reports cross-site scripting findings even
  when encoding is applied and presents them as Cross-Site Scripting: Poor Validation issues.</p>