Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages (Release Update)

To prevent malicious code from executing in cross-site scripting (XSS) attacks on your Visualforce pages, this release update escapes the label attribute of your <apex:inputField> tags. This update was first available in Winter ’23.

Where: This change applies to Salesforce Classic and Lightning Experience in Professional, Enterprise, Performance, Unlimited, and Developer editions. Lightning console apps are available for an extra cost to users with Salesforce Platform user licenses for certain products. Some restrictions apply. For pricing details, contact your Salesforce account executive.

When: Salesforce enforced this update for most orgs in Spring ’23. Salesforce enforces this update for all remaining orgs in Spring ’26. To get the major release upgrade date for your instance, go to Trust Status, search for your instance, and then click the maintenance tab.

Why: This update improves the security of your Visualforce pages by automatically escaping the label attribute of all your existing <apex:inputField> elements. It also escapes the label attribute for <apex:inputField> elements that you create after enabling the update.

How: To review this release update, from Setup, in the Quick Find box, enter Release Updates, and then select Release Updates. For Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages, follow the testing and activation steps.

After this update is enforced, label attributes that you already escaped are double-escaped. Double-escaped attributes don’t render correctly on Visualforce pages. For instructions on how to locate and fix double-escaped attributes, see the testing steps for this release update.