---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Escape XML markup \[Updated in Security Center 1.3\]

# Escape XML markup \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.ui.escape_text property to force escape of XML
values at the parser level before transmitting them to the client's browser.
Cross-site scripting occurs when an attacker injects malicious JavaScript into an entry point. The platform/application fails to escape the malicious JavaScript before transmitting it to the victim's browser for execution. Escaping in this context means the following:

* \& --\> `&`
* \< --\> `&lt;`
* \> --\> `&gt;`
* " --\> `&quot;`
* ' --\> `&#x27;`
* / --\> `&#x2F;`
{#sc-escape-xml__ul_dj2_f1n_dlb}

Example: `<script>alert('XSS Attack');</script>`

Escaping: `&lt;script&gt;alert(&#39;XSS
Attack&#39;);&lt;/script&gt;`

Ensure the glide.ui.escape_text property exists in the sys_properties table and is set to true.  
Warnung:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-escape-xml__section_more_information}

{#sc-escape-xml__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.ui.escape_text |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | Escaping XML ensures that browsers do not parse the malicious JavaScript embedded in untrusted data, and execute it as JavaScript. * A malicious user may try XSS attack to either hijack other users' session or redirect the user to a malicious website. * The NOW Platform contains code to secure cookies, but escaping it relies on this property being set to true. {#sc-escape-xml__ul_dmj_z5v_nkb} |
| Recommended value | true |
| Security risk rating | 8.8 |
| Functional impact | This remediation enforces XML encoding at the XML parser level on the UI. It renders the encoded results for the user, which can have a functionality impact based on the instance user interaction with the resulted data. |
| Security risk | (High) Input validation must occur on the application to defend against cross-site scripting attacks. These attacks enable foreign scripts to execute on user session in the logged in browser's context. Attackers can use it to steal session information and sensitive data. |
| Workaround | After you set this property to true, rendering stops on the HTML tags in the catalog item description or in the catalog item variable help text. You may not be able to use HTML formatting for some fields. However, if the glide.ui.escape_text property is turned of, all JEXL expressions would be prefixed with an output encoder: `$⁠{JS:expression}` `$⁠{HTML:expression}` or `$⁠{JS,HTML:expression}` |
[ ]

{#sc-escape-xml__table_ajc_b43_3kb}