LPS-32529 - Again with explanation...

Hi Brian,

UnicodeFormatter doesn't "HTML" escape. We need to escape the content because while using UnicodeFormatter prevents XSS, it preserves the html, so when we actually write it to the output stream, it becomes valid html and so the browser doesn't display it. Html escape changes the characters "<" is not the same as < even if they are displayed the same.

The customer actually complained about not seeing what he entered and not about it being an XSS...