---
schema_version: "1"
id: 3065551098dc283bde095a0bac536277b7b4ea181582df8108577aa2e3652d63
title: Cross-Site Scripting in B2C Commerce
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_cross_site_scripting.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_cross_site_scripting.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: fdf89f098f535ad9068af742914c63150b8ddcdd6da9c6adbb097aac5cdb8dc0
description: Cross-site scripting (XSS) enables attackers to inject client-side JavaScripts into a webpage viewed by a targeted user. To prevent malicious attacks through content manipulation, you must properly encode all user-provided content.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Cross-Site Scripting in B2C Commerce

Cross-site scripting (XSS) enables attackers to inject client-side JavaScripts into a webpage viewed by a targeted user. To prevent malicious attacks through content manipulation, you must properly encode all user-provided content.

For example, pay close attention to how you use the Salesforce B2C Commerce Internet Store Markup Language (ISML) templates and script APIs when dealing with user-entered data.

ISML templates provide two ways to print variable values. You can use `${...}` and replace the ellipsis with the variable to be displayed **or** you can use the `<isprint>` tag.

If you use a script expression such as ${pdict.ProductSearchResult.searchPhrase} in an ISML template, where the content type is set as follows, the script result is automatically HTML encoded.

```markup
<iscontent type="text/html" charset="UTF-8" compact="true">...</iscontent>
```

However, if you use the same expression in an ISML template that’s included via `<isinclude template=">` and no content type is set in the included ISML snippet, B2C Commerce assumes that the content type _text/plain_ and no HTML encoding takes place. This is inconsistent and can lead to XSS problems.

To correct this, you must explicitly set the content type or use `<isprint value="{}"/>` to make sure that you encode the resulting HTML.

Here's an example of an insecure `<isprint>` tag.

`<isprint value="${pdict.ProductSearchResult.searchPhrase}"/>`

Do not use HTML encoding for scenarios. The `isprint` tag has an encoding attribute to encode user-entered data. Here's a secure example of using an `<isprint>` tag.

`<isprint value="${pdict.ProductSearchResult.searchPhrase}" encoding="jshtml"/>`

In summation, use only the appropriate encoding for its respective designed context.