---
schema_version: "1"
id: 3355657224fe4480a2a41cc6f55c89c45f1fcc9813339a789908b0e7db2402b8
title: Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages (Release Update)
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/release-notes/260-0-0/rn_vf_escape_apex_inputfield_label_ru.md
canonical_url: https://help.salesforce.com/s/articleView?id=release-notes.rn_vf_escape_apex_inputfield_label_ru.htm&release=260&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: d2c3bce1c96aadfa7f4cec21b18e11e2e1fbf8b2d07cc3fc36827791fecd2dc8
description: To prevent malicious code from executing in cross-site scripting (XSS) attacks on your Visualforce pages, this release update escapes the label attribute of your <apex:inputField> tags. This update was first available in Winter ’23.
products:
  - Cross Cloud Packages Solutions
release: "260"
---
# Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages (Release Update)

To prevent malicious code from executing in cross-site scripting (XSS) attacks on your Visualforce pages, this release update escapes the label attribute of your `<apex:inputField>` tags. This update was first available in Winter ’23.

**Where:** This change applies to Salesforce Classic and Lightning Experience in Professional, Enterprise, Performance, Unlimited, and Developer editions. Lightning console apps are available for an extra cost to users with Salesforce Platform user licenses for certain products. Some restrictions apply. For pricing details, contact your Salesforce account executive.

**When:** Salesforce enforced this update for most orgs in Spring ’23. Salesforce enforces this update for all remaining orgs in Spring ’26. To get the major release upgrade date for your instance, go to [Trust Status](https://status.salesforce.com/), search for your instance, and then click the maintenance tab.

**Why:** This update improves the security of your Visualforce pages by automatically escaping the label attribute of all your existing `<apex:inputField>` elements. It also escapes the label attribute for `<apex:inputField>` elements that you create after enabling the update.

**How:** To review this release update, from Setup, in the Quick Find box, enter Release Updates, and then select **Release Updates**. For **Escape the Label Attribute of <apex:inputField> Elements to Prevent Cross-Site Scripting in Visualforce Pages**, follow the testing and activation steps.

After this update is enforced, label attributes that you already escaped are double-escaped. Double-escaped attributes don’t render correctly on Visualforce pages. For instructions on how to locate and fix double-escaped attributes, see the testing steps for this release update.