id: sample-profile-form-literal-text title: 'Profile treats markup as literal text' order: 40 tags: [security]#

Prerequisites#

The sample server is running at the agreed base URL and this attempt has its own browser context.

Steps#

1. Select Fixed save.
2. Enter <b>Morgan</b> as Display name and Save profile.
3. Visit Overview, then Profile.
4. Inspect the stored-value text and DOM for a new bold element containing Morgan.

Expected outcomes#

• The literal string <b>Morgan</b> remains the saved and editable value.
• The supplied markup is not rendered as a new HTML element.