Question: ```
<!DOCTYPE html>
<html>
<head>
<script src="https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js"></script>
<script>
$(document).ready(function(){
var $type
    $('button').click(function(){

    if($(this).text() == "Click Me") {
    var $type = "passme";
    }
});

$('button[type=submit]').click(function(){
alert($type);
});

});
</script>
</head>
<body>

<button type="submit">Click Me</button>
</body>
</html>

```

I need to somehow get this $type variable over to the other selector, I have been at this for hours and have no idea how to do it?

If I put them in the same selector (Like a selector in a selector) it alerts multiple times and really gets messed up.

Answer: 
This question is borderline NOT a good question for SO, but at the same time, it's definitely going to come up for just about anyone at this point. So I'll mark this off as a community wiki, and it can be migrated to a better home later. 

So the core question is this:

> 
> So my question is, after removing ESAPI I have found some lines of
>  code that use is like this:
> 
> 
> `ESAPI.encoder().encodeForJavaScript(ControllerHelper.getJavascriptStuff());`
>  What should I use as a replacement? and why?
> 
> 
> 

IF *ALL* you need is an encoder, use the lightweight [OWASP Encoder Project.](https://github.com/OWASP/owasp-java-encoder) 

However that project won't also give you a decoder. 

The *why* part. The part that deserves a wiki. 

In all application development, its the responsibility of the programmer to ensure that data is *always* treated *only* as data. In the case you present here, the developer was using the encoder to ensure that data passed to the client, was always going to be treated as data by the JavaScript interpreter. 

Failure to do this *could* result in a user submitting for example, javascript code as input, and then your application then turning around and serving it to another user. In the worst case, it could be used to drop a malware file inside the perimeter of the corporate network. 

But there could be more to worry about here as well. Is the javascript payload going to be rendered into HTML? If so, then maybe it should be HTML-encoded first. Preventing XSS is a broad topic, you can get started [here.](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet)
StringUtils.escapeJava(str) works and did not shows in vulnerability.