\
**Category:** Experience Manager (PaaS/OnPrem)\
**Created:** [September 18, 2018, 10:24am UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420 "2018-09-18T10:24:14Z")\
**Posts on this page:** 7\
**Page:** 1
**Author:**  [@Hikmet\_Pasa](https://community.bloomreach.com/u/Hikmet_Pasa)\
**Post date:** [September 18, 2018, 10:24am UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/1 "2018-09-18T10:24:14Z")
Hi there,
This is my first post here, so tell me if I am posting at the wrong place.
We have updated or hippo environment to the latest version of Hippo 11.xxx and also had some other custom changes.
Let me try to explain the error.
We have a document.
This document has a rich field field.
In this rich field we are using a variable ${test.test}
This variable has some html code in it: \< p \>This is a test\< / p \>
And after this update we are seeing: \< p \>This is a test\< / p \> on the page instead of: This is a test
Can someone maybe help me with this?
---
**Author:**  [@machak](https://community.bloomreach.com/u/machak)\
**Post date:** [September 18, 2018, 10:46am UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/2 "2018-09-18T10:46:40Z")
You can use escapeMessageXml=false attribute:
```
Whether or not to escape a message value having &,>,<,", and '. When escapeMessageXml = true, the
replaced message text can be safely used as a tag attribute (e.g, href, src, etc.) value.
By default escapeMessageXml is set to true.
escapeMessageXml
false
false
java.lang.Boolean
```
---
**Author:**  [@Hikmet\_Pasa](https://community.bloomreach.com/u/Hikmet_Pasa)\
**Post date:** [September 18, 2018, 12:10pm UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/3 "2018-09-18T12:10:17Z")
Thanks you very much machak.
But why is this now needed?
It did work without this, in previous release ☹
---
**Author:**  [@jeroen.hoffman](https://community.bloomreach.com/u/jeroen.hoffman)\
**Post date:** [September 18, 2018, 12:43pm UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/4 "2018-09-18T12:43:12Z")
Hi,
This was a changed behavior in 12.3 to mitigate an XSS vulnerability in the HST.
See [https://www.onehippo.org/library/upgrade-minor-versions/upgrade-12.2.0-to-12.2.1-or-12.3.0.html](https://www.onehippo.org/library/upgrade-minor-versions/upgrade-12.2.0-to-12.2.1-or-12.3.0.html).
Jeroen
---
**Author:**  [@Hikmet\_Pasa](https://community.bloomreach.com/u/Hikmet_Pasa)\
**Post date:** [September 18, 2018, 12:56pm UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/5 "2018-09-18T12:56:03Z")
Thanks jeroen, but I am not talking about release 12.3.
I just upgraded from 11.1.1 to 11.2.8 !
Did we also had same change between those versions?
---
**Author:**  [@jeroen.hoffman](https://community.bloomreach.com/u/jeroen.hoffman)\
**Post date:** [September 18, 2018, 1:22pm UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/6 "2018-09-18T13:22:44Z")
Yes, because of its security-related nature this change was back ported, see
[https://www.onehippo.org/11/library/upgrade-minor-versions/upgrade-11.2.6-to-11.2.7.html](https://www.onehippo.org/11/library/upgrade-minor-versions/upgrade-11.2.6-to-11.2.7.html)
HTH
Jeroen
---
**Author:**  [@Hikmet\_Pasa](https://community.bloomreach.com/u/Hikmet_Pasa)\
**Post date:** [September 18, 2018, 1:35pm UTC](https://community.bloomreach.com/t/hippo-site-shows-html-code/420/7 "2018-09-18T13:35:01Z")
thanks for the answers all.
Now I know why and how I can solve it.