---
title: Calls To addError With Disabled Escaping Should Be Avoided
description: "Impact Area Security Severity High Affected Element Apex Class ## Rule ID **SF-0021** ## Impact The message passed to addError will be displayed directly to the user in the UI, making it prime ground for XSS attacks if unescaped. ## Remediation Ensure…"
url: "https://community-staging.qualityclouds.com/qcdocs/qc/pmd-rules/calls-to-adderror-with-disabled-escaping-should-be-avoided/"
updated: "2025-03-21"
category: PMD Rules
---

# Calls To addError With Disabled Escaping Should Be Avoided

Impact Area

Security

Severity

High

           Affected Element

Apex Class

## Rule ID

**SF-0021**

## Impact

The message passed to addError will be displayed directly to the user in the UI, making it prime ground for XSS attacks if unescaped.

## Remediation

Ensure that all calls to the addError function are escaped.

### Time to fix

60 min