---
sourceDocument: Australia Platform security
sourceDocumentLink: https://servicenow-prod.fluidtopics.net/r/de-DE/platform-security

 Release :

    - australia

ft:locale :

    - de-DE

ft:publication_title :

    - Australia Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Enable HTML Sanitizer \[Updated in Security Center 1.3\]

# Enable HTML Sanitizer \[Updated in Security Center 1.3\] {#ariaid-title1}

* Freigeben Version: Australia
* 
* Aktualisiert 12. März 2026
* 
* ![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 Minute Lesedauer

Use the glide.html.sanitize_all_fields property to enable the
HTMLSanitizer script include, which sanitizes HTML input based on exclusion listed and inclusion
listed attributes configured in a script.
The field types available with dictionary/fields include HTML and Translated HTML. These
HTML input fields enable users to write HTML formatted input, for example:

`<h1>Test</h1>`, using the most basic HTML tags such as `<img>`, `<a href ...>`, and `<iframe>`.

It can open a door for a malicious attacker to inject malicious vector with HTML tags such
as:

`[<IMG SRC=" &#14; JavaScript:alert('XSS');">][<IMG
onmouseover="alert('xss')">],[a href="" onclick=alert(/xss/)]`.

## More information {#sc-html-sanitizer__section_more_information}

{#sc-html-sanitizer__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Property name | glide.html.sanitize_all_fields |
| Configuration type | System Properties (/sys_properties_list.do) |
| Category | [Validation, sanitization, and encoding](https://servicenow-prod.fluidtopics.net/F1nREUr0FIKK6cga6jbKwg "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Purpose | Prevents application against cross site scripting and HTML injection attacks |
| Recommended value | true |
| Default value | true |
| Security risk rating | 8.8 |
| Functional impact | This remediation enforces HTML-output encoding mechanism before the user data is rendered back to the user. If customer has any customization that involves rendering of the HTML attribute or content data, then there is a functionality impact. |
| Security risk | (High) User input should be securely treated when the data is being stored and processed on the application.This reduces client-side cross-site scripting attacks by output encoding the data. |
| Workaround | This property sanitizes all HTML fields in the system. If you must enable HTML sanitization on individual fields, see [Enable sanitization on individual fields](https://servicenow-prod.fluidtopics.net/UGEzyhTyb3bdOqGu_bwXzQ "You can use field attributes to enable or disable the sanitizer on individual fields."). You can also configure the inclusion list or exclusion list to sanitize HTML tags and attributes as per your organizations policy. |
| References | [Enabling HTML sanitizer](https://servicenow-prod.fluidtopics.net/vUFgy2uAkFEqsW6YX6MCYw "The HTML sanitizer provides a property to enable or disable the sanitizer for all HTML fields in the system.") [HTML sanitizer](https://servicenow-prod.fluidtopics.net/jKm9JeUj1v9E8ocKhC8gJQ "Remove unwanted code and protect against security concerns such as cross-site scripting attacks by sanitizing HTML markup in HTML fields and translated HTML fields.") |
[ ]

{#sc-html-sanitizer__table_ajc_b43_3kb}

To learn more about adding or creating a system
property, see [Add a system property](https://www.servicenow.com/docs/access?context=t_AddAPropertyUsingSysPropsList&version=australia&pubname=australia-platform-administration&ft:locale=en-US).