SALESFORCE-PD1 User Interface Practice Question
A developer is implementing a Visualforce page that displays a list of accounts and needs to ensure that it adheres to Salesforce security best practices by preventing cross-site scripting (XSS) attacks. Which tag or attribute combination should be used to securely output user-supplied data?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
<apex:outputText value="{!userSuppliedInput}" escape="true" />
The apex:outputText tag automatically escapes HTML by default, preventing XSS. Alternatively, setting escape=true on bindings ensures safety.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
<apex:includeScript value="{!userSuppliedScript}" />
Why it's wrong here
Incorrect. apex:includeScript is used for including JavaScript resource files, not for outputting text safely.
- ✗
<apex:outputField value="{!account.Name}"> with escape="false"
Why it's wrong here
Incorrect. Setting escape to false disables HTML encoding and can expose the page to XSS.
- ✓
<apex:outputText value="{!userSuppliedInput}" escape="true" />
Why this is correct
Correct. Setting escape="true" on apex:outputText ensures that user input is properly encoded to prevent XSS.
- ✗
{!$User.UIThemeDisplayed} without any wrappers
Why it's wrong here
Incorrect. Raw expression binding without proper context can sometimes output unescaped content depending on the context.
About these practice questions
This SALESFORCE-PD1 question is part of Courseiva's 488-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official Salesforce exam blueprint
This SALESFORCE-PD1 practice question is part of Courseiva's free Salesforce certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SALESFORCE-PD1 exam.