bx-esapi

Name: bx-esapi
Availability: InStock
Author: BoxLang

Encode, decode, and sanitize HTML in BoxLang with ESAPI.

Updated Apr 10, 2026

Search Tags:#security #xss #sanitization #encoding #boxlang #antisamy #esapi

Ready to run

npx skills add https://github.com/ortus-boxlang/skills --skill bx-esapi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: bx-esapi
Source: https://github.com/ortus-boxlang/skills/tree/main/boxlang-modules/bx-esapi
Command: npx skills add https://github.com/ortus-boxlang/skills --skill bx-esapi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Prevents cross-site scripting and injection by offering ESAPI-based encoding, decoding, and HTML sanitization in BoxLang, enabling safe rendering of user input.

Core Features & Use Cases

Robust encoding across contexts: HTML, HTMLAttribute, JavaScript, CSS, URL, SQL, XML, LDAP, and more.
Decoding and canonicalization: decodeFromHTML(), decodeFromURL(), and related operations with safe handling.
HTML sanitization: htmlSanitize() with built-in and policy-based AntiSamy support to strip dangerous content.

Quick Start

Call encodeForHTML on user input before rendering it into HTML to prevent XSS.

Frequently Asked Questions about bx-esapi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent XSS in BoxLang when rendering user input?▼

To prevent XSS in BoxLang, call encodeForHTML on user input before rendering it into HTML content. This ESAPI-based encoding mitigates cross-site scripting by safely escaping dangerous characters in the rendered output.

What contexts does ESAPI encoding support beyond standard HTML in BoxLang?▼

ESAPI encoding in BoxLang supports HTML attributes, inline JavaScript, CSS, URLs, SQL, XML, and LDAP contexts. It provides robust context-aware encoding across these multiple injection vectors to ensure safe data rendering.

Can I sanitize untrusted HTML content using AntiSamy policies in BoxLang?▼

Yes, you can sanitize untrusted HTML using the htmlSanitize function with AntiSamy support. It strips dangerous content from user input using built-in rules or optional custom policy files for safe rendering.

Does BoxLang ESAPI support decoding and canonicalizing encoded URL and HTML strings?▼

Yes, BoxLang ESAPI supports decoding and canonicalization through decodeFromHTML and decodeFromURL operations. These functions safely handle the reversal of encoded strings back to their original forms.

Do I need policy files to use the ESAPI sanitization features in BoxLang?▼

Policy files are optional for ESAPI sanitization in BoxLang. The htmlSanitize function offers built-in AntiSamy support by default, but allows you to supply custom policy files when stricter content filtering rules are required.