SALESFORCE-PD1 User Interface Practice Question
Which THREE practices are considered security best practices when developing custom Visualforce pages to prevent Cross-Site Scripting (XSS)? Choose 3 answers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use standard Visualforce components like <apex:outputText> which automatically HTML-escape output by default.
Preventing XSS in Visualforce involves escaping output, using standard components which escape by default, and encoding untrusted data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use standard Visualforce components like <apex:outputText> which automatically HTML-escape output by default.
Why this is correct
Standard components escape output safely.
- ✗
Disable sharing on all controller classes.
Why it's wrong here
Disabling sharing relates to sharing rules, not XSS.
- ✗
Set escape="false" on all output components to ensure proper rendering.
Why it's wrong here
escape=false introduces XSS vulnerabilities if data is untrusted.
- ✓
Use String.escapeJavaScript() when rendering user input inside JavaScript contexts.
Why this is correct
Escapes strings for safe JS execution.
- ✓
Encode untrusted user input using JSENCODE or HTMLENCODE helper functions.
Why this is correct
Visualforce expression functions protect against injection.
About these practice questions
This SALESFORCE-PD1 question is part of Courseiva's 488-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Salesforce exam blueprint
This SALESFORCE-PD1 practice question is part of Courseiva's free Salesforce certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SALESFORCE-PD1 exam.