{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":41436,"path":"platform-security/instance-security-hardening-settings/sc-escape-html.md","title":"Escape HTML in list views \\[Updated in Security Center 1.3 and 1.5\\]","bundle":null,"doc_type":null,"release":"australia","body":"\n# Escape HTML in list views \\[Updated in Security Center 1.3 and 1.5\\]\n\nUse the **glide.ui.escape\\_html\\_list\\_field** property to force HTML escapes for HTML fields in a list view.\n\nSet **glide.ui.escape\\_html\\_list\\_field** to **true** to prevent HTML from being rendered in HTML fields in list view. Leaving HTML sanitization inactive platform wide \\(via system property\\) or by field \\(via a schema attribute\\), may lead to XSS style attacks. XSS attacks may allow a low privileged user to hijack the session of a high privileged user or interfere in standard web application behaviors, including redirects or defacement.\n\n**Warning:** This is a safe harbor property, meaning the value can't be altered once it's changed. It’s non-revertible.\n\n## More information\n\n<table id=\"table_ajc_b43_3kb\"><thead><tr><th>\n\nAttribute\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nProperty name\n\n</td><td>\n\n**glide.ui.escape\\_html\\_list\\_field**\n\n</td></tr><tr><td>\n\nConfiguration type\n\n</td><td>\n\nSystem Properties \\(/sys\\_properties\\_list.do\\)\n\n</td></tr><tr><td>\n\nCategory\n\n</td><td>\n\n[Validation, sanitization, and encoding](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/validation-sanitization-encoding.md)\n\n</td></tr><tr><td>\n\nPurpose\n\n</td><td>\n\nTo help prevent application against cross-site scripting attacks\n\n</td></tr><tr><td>\n\nRecommended value\n\n</td><td>\n\ntrue\n\n</td></tr><tr><td>\n\nDefault value\n\n</td><td>\n\ntrue\n\n</td></tr><tr><td>\n\nSecurity risk rating\n\n</td><td>\n\n3.1\n\n</td></tr><tr><td>\n\nFunctional impact\n\n</td><td>\n\nThis remediation enforces HTML encoding to occur on the UI at the HTML parser level and thus renders back encoded results to the user. It can have a functionality impact based on the instance user interaction with the resulted data.\n\n</td></tr><tr><td>\n\nSecurity risk\n\n</td><td>\n\n\\(High\\) Input validation must occur on the application to defend against cross-site scripting attacks. These attacks enable foreign scripts to execute on user sessions in the logged in browser's context. Attackers can use it to steal session information and sensitive data.\n\n</td></tr><tr><td>\n\nReferences\n\n</td><td>\n\n[High Security Settings](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/c_HighSecuritySettings.md)\n\n</td></tr></tbody>\n</table>To learn more about adding or creating a system property, see [Add a system property](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/platform-administration/t_AddAPropertyUsingSysPropsList.md).\n\n**Parent Topic:**[Validation, sanitization, and encoding](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/platform-security/instance-security-hardening-settings/validation-sanitization-encoding.md)\n\n"}}