title: Test XSS vulnerability of a website which is using smartgwt
body: <p>I am testing whether I can inject script code into a website which is using smartgwt and then queried out the input string to run the script.</p>
  
  <p>I first input the following string into a text field on a webpage and submitted:</p>
  
  <p><code>"&lt;script&gt;alert(1)&lt;/script&gt;"</code>(without double quotes),</p>
  
  <p>then I queried out the input string which is loaded through a smartgwt table component. </p>
  
  <p>With a HTML debug tool, I can see that the input string was placed inside a <code>&lt;nobr&gt;</code> tag inside a <code>&lt;td&gt;</code> tag, the HTML characters inside the input string wasn't encoded, but the <code>alert(1)</code> code doesn't execute and no popup was shown, does smartgwt handle the XSS automatically, or there is other reason that the script isn't executed?</p>