# Embedded form allows <script> to be saved

**URL:** <https://community.hubspot.com/t/embedded-form-allows-lt-script-gt-to-be-saved/92517>\
**Category:** APIs & Integrations\
**Tags:** forms\
**Created:** [October 24, 2023, 11:14pm UTC](https://community.hubspot.com/t/embedded-form-allows-lt-script-gt-to-be-saved/92517 "2023-10-24T23:14:39Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![RBoyd9](https://avatars.discourse-cdn.com/v4/letter/r/8dc957/32.png) [@RBoyd9](https://community.hubspot.com/u/RBoyd9)\
**Post date:** [October 24, 2023, 11:14pm UTC](https://community.hubspot.com/t/embedded-form-allows-lt-script-gt-to-be-saved/92517/1 "2023-10-24T23:14:39Z")

</div>

We have noticed that \<script\>\</script\> can be saved into HubSpot via an embedded form. When we use Hubl to display the values saved into a webpage, the script is now embedded in the page.

The Hubspot API disallows \<script\>, can forms submission disallow this also? Or atleast can we have a safe way to display the values via Hubl?

I’ve used a temporary solution

` |striptags`

But we’d need to apply this site wide. Can we globally set this?

We can sanitize the string on the front end but would need to hijack the submit button which isn’t ideal

---

<div class="post-metadata">

**Author:** ![Jaycee\_Lewis](https://d10pqhm3lwygmk.cloudfront.net/user_avatar/community.hubspot.com/jaycee_lewis/32/61352_2.png) [@Jaycee\_Lewis](https://community.hubspot.com/u/Jaycee_Lewis)\
**Post date:** [October 25, 2023, 10:15pm UTC](https://community.hubspot.com/t/embedded-form-allows-lt-script-gt-to-be-saved/92517/2 "2023-10-25T22:15:25Z")

</div>

Hi, @RBoyd9 👋 Thank you very much for the question. I’d like to invite some of our community champions to the conversation — hey @Anton @Teun [@Phil\_Vallender](https://community.hubspot.com/t5/user/viewprofilepage/user-id/74), do you have any experience here?

Thank you for taking a look! — Jaycee