---
sourceDocument: Brazil Platform security
sourceDocumentLink: https://www.servicenow.com/docs/r/platform-security

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil Platform security

ft:clusterId :

    - psec

bundleId :

    - psec

workflow :

    - Platform


---

# Escape XML markup

# Escape XML markup {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Use the glide.ui.escape_text property to force escape of XML
values at the parser level before transmitting them to the client's browser.
Use the glide.ui.escape_text system property to escape XML values at the parser level for the user interface. It prevents reflected and stored cross-site scripting attacks. This property is not applicable in
Service Portal.  
Cross-site scripting occurs when an attacker injects malicious JavaScript into an entry point. The platform/application fails to escape the malicious JavaScript before transmitting it to the victim's browser for execution. Escaping in this context means the following:

* \& --\> `&`
* \< --\> `&lt;`
* \> --\> `&gt;`
* " --\> `&quot;`
* ' --\> `&#x27;`
* / --\> `&#x2F;`
{#sc-escape-xml__ul_dj2_f1n_dlb}

Example: `<script>alert('XSS Attack');</script>`

Escaping: `&lt;script&gt;alert(&#39;XSS
Attack&#39;);&lt;/script&gt;`

Ensure the glide.ui.escape_text property exists in the System Properties \[sys_properties\] table and is set to true.  
Warning:  
This is a safe harbor property, meaning the value can't be altered once it's changed. It is non-revertible.

## More information {#sc-escape-xml__section_wc1_cqn_phc}

{#sc-escape-xml__table_ajc_b43_3kb__entry__2}

| Attribute | Description |
|-|-|
| Configuration name | glide.ui.escape_text |
| Configuration type | System Properties (/sys_properties_list.do) |
| Data type | Boolean |
| Recommended value | true |
| Default value | true |
| Fallback value | false |
| Category | [Validation, sanitization, and encoding](https://www.servicenow.com/docs/Y54hkYpvZcFtgJ5PMM2JEw "Validation, sanitization, and encoding addresses input validation to prevent against vulnerabilities like Cross-Site Scripting (XSS), SQL injection and other attacks.") |
| Security risk | * Severity score: 8.8 * CVSS rating: High * Security risk details: If glide.ui.escape_text is not set to the recommended value of true, then XML values will not be escaped at the parser level for the user interface; this will leave jelly templates susceptible to reflected and stored cross site scripting attacks. {#sc-escape-xml__ul_g1g_3sf_xwb} |
| Functional impact | None |
| Dependencies and prerequisites | None |
[ ]

{#sc-escape-xml__table_ajc_b43_3kb}