Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25
Welcome to Pass4Success

- Free Preparation Discussions
Mail Us support@pass4success.com
Location US
Mob_nav_barsMENU

Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 74 Discussion

A developer is checking for Cross Site Scripting (XSS) and found that the quick search is not escaped (allows inclusion of Javascript) in the following script:How would the developer resolve this issue?
B) Use <isprint value='${searchPhrase}* encoding-'jshtmr />
A) Replace 'with double Quote*
C) Use <isprint value='${searchPhrase} encoding-'jsblock' />
D) Use <toprint value='${searchPhrase}' />

Salesforce Certified B2C Commerce Architect (Arch-303) Exam - Topic 1 Question 74 Discussion

Actual exam question for Salesforce's Salesforce Certified B2C Commerce Architect (Arch-303) exam
Question #: 74
Topic #: 1
[All Salesforce Certified B2C Commerce Architect (Arch-303) Questions]

A developer is checking for Cross Site Scripting (XSS) and found that the quick search is not escaped (allows inclusion of Javascript) in the following script:

How would the developer resolve this issue?

Show Suggested Answer Hide Answer
Suggested Answer: B

To resolve the issue of Cross Site Scripting (XSS) where the quick search is not escaped, the developer should use the <isprint> tag with the 'jshtml' encoding option (Answer B). This method ensures that any JavaScript included in the search phrase is properly escaped, preventing the execution of potentially malicious scripts. The 'jshtml' encoding is specifically designed to encode text for HTML contexts where JavaScript is embedded, providing a secure way to handle user input in Salesforce B2C Commerce.


by Halina at Mar 05, 2026, 08:27 AM

Limited Time Offer

25%

Off

Get Premium Salesforce Certified B2C Commerce Architect (Arch-303) Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

0/2000 characters
Submit Cancel
Lawrence
3 days ago
Option C seems good too, but I prefer B for clarity.
upvoted 0 times
...
Rhea
8 days ago
I think option B is the best. It properly encodes for JavaScript.
upvoted 0 times
...
Niesha
13 days ago
This XSS issue is serious. We need to escape inputs.
upvoted 0 times
...
Vicki
18 days ago
I feel like A is too risky. Double quotes can lead to issues.
upvoted 0 times
...
Matilda
24 days ago
Option C could work too, but B is more straightforward.
upvoted 0 times
...
Phil
29 days ago
I agree, B seems secure. We need to prevent XSS.
upvoted 0 times
...
Shoshana
1 month ago
I think option B is the best choice. It properly encodes for JavaScript.
upvoted 0 times
...
Onita
1 month ago
Double quotes won't fix the escaping issue, so A is not the way to go.
upvoted 0 times
...
Denny
1 month ago
Just using toprint won't be enough, we need proper encoding.
upvoted 0 times
...
Patria
2 months ago
Surprised that this issue wasn't caught earlier!
upvoted 0 times
...
Van
2 months ago
I disagree, I think option C is better for handling special characters.
upvoted 0 times
...
Marla
2 months ago
Option B seems like the safest choice for XSS prevention.
upvoted 0 times
...
Marsha
2 months ago
Double quotes in A? That doesn't sound right for escaping.
upvoted 0 times
...
Ranee
2 months ago
D is just printing it out, that won't help with XSS!
upvoted 0 times
...
Lemuel
4 months ago
Wait, are we really trusting user input at all?
upvoted 0 times
...
Jade
4 months ago
I think C is better, it looks more secure to me.
upvoted 0 times
...
Lawrence
4 months ago
Option B seems like the safest choice for XSS prevention.
upvoted 0 times
...
Noah
4 months ago
C looks good, but I wonder if it covers all cases.
upvoted 0 times
...
Melvin
5 months ago
I disagree, A won't fix the escaping issue properly.
upvoted 0 times
...
Rolland
5 months ago
Wait, are we really allowing JavaScript in the search? That's risky!
upvoted 0 times
...
Amie
5 months ago
I think D is a solid option too, but not sure if it's the best.
upvoted 0 times
...
Glory
5 months ago
Option B seems like the best choice for XSS protection.
upvoted 0 times
...
Chaya
5 months ago
I recall that using is generally a good practice for escaping, but I can't remember if it's the right choice here.
upvoted 0 times
...
Wynell
5 months ago
I'm a bit confused about the difference between 'jshtmr' and 'jsblock'—I feel like I need to review those examples again.
upvoted 0 times
...
Nieves
6 months ago
I think option C sounds familiar; it might be the one we practiced that uses 'jsblock' encoding.
upvoted 0 times
...
Vallie
6 months ago
I remember we discussed XSS prevention techniques, but I'm not entirely sure which encoding method is the best for this case.
upvoted 0 times
...

Save Cancel