---
id: sample-profile-form-literal-text
title: 'Profile treats markup as literal text'
order: 40
tags: [security]
---

## Prerequisites

The sample server is running at the agreed base URL and this attempt has its own browser context.

## Steps

1. Select Fixed save.
2. Enter <b>Morgan</b> as Display name and Save profile.
3. Visit Overview, then Profile.
4. Inspect the stored-value text and DOM for a new bold element containing Morgan.

## Expected outcomes

- The literal string <b>Morgan</b> remains the saved and editable value.
- The supplied markup is not rendered as a new HTML element.