---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Escape JavaScript \[Updated in Security Center 1.3\]

# Escape JavaScript \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.html.escape_script property to force escape from
JavaScript (`<script></script>`) tags in HTML fields during list
views.
The glide property glide.html.escape_script helps sanitize HTML
fields. If glide.html.escape_script is not set to the recommended
value of true, then inputs will not be sanitized for HTML fields (output encoding) from
a backend Java context by removing embedded JavaScript. Javascript in HTML fields can
lead to stored and reflected XSS. The ability to have XSS can lead to easily attained
privilege escalation to higher roles such as admin where more lateral movement can be
taken.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-escape-javascript__section_more_information}

{#sc-escape-javascript__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.html.escape_script |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | To prevent cross-site scripting attacks against an application. |
| Recommended value | true |
| Default value | true |
| Security risk rating | 8.8 |
| Functional impact | This remediation enforces JavaScript escaping to occur on the UI and renders encoded results to the user. It can have an impact on functionality, based on the instance user interaction with the resulting data |
| Security risk | (High) Input validation must occur in the application to defend against cross-site scripting attacks. These attacks enable foreign scripts to execute on user session in the logged in browser's context. Attackers can use it to steal session information and sensitive data. |
| References | [Available system properties](https://www.servicenow.com/docs/access?context=r_AvailableSystemProperties&version=australia&pubname=australia-platform-administration&ft:locale=en-US) [High Security Settings](https://servicenow-prod.fluidtopics.net/f8gVxeeTKuTUbGIE_Ua8hw "High Security Settings refer to several security options available in your instance.") |
[ ]

{#sc-escape-javascript__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).