diff --git a/WebContent/WEB-INF/jsp/systemSettings.jsp b/WebContent/WEB-INF/jsp/systemSettings.jsp
index c8e12ff94..e672a1e3e 100644
--- a/WebContent/WEB-INF/jsp/systemSettings.jsp
+++ b/WebContent/WEB-INF/jsp/systemSettings.jsp
@@ -1151,7 +1151,7 @@
               id="cssEditor"
               class="hgl-editor"
               spellcheck="false"
-              oninput="updateCodeTextEscaped(this.value, '#cssHighlightingContent');"
+              oninput="updateCodeText(this.value, '#cssHighlightingContent');"
               onscroll="syncCodeScroll(this, '#cssHighlightingContent');">
             </textarea>
             <pre id="cssHighlighting" class="hgl-highlighting" aria-hidden="true">
diff --git a/build.gradle b/build.gradle
index 352a67a2a..711ec0d32 100644
--- a/build.gradle
+++ b/build.gradle
@@ -241,8 +241,9 @@ test {
         includeTestsMatching "com.serotonin.mango.util.StartStopDataPointsUtilsTestsSuite"
         includeTestsMatching "org.scada_lts.utils.BlockingQueuesUtilsTest"
         includeTestsMatching "org.scada_lts.web.security.XssProtectHtmlEscapeUtilsTest"
-        includeTestsMatching "org.scada_lts.web.security.XssUtilsTest"
+        includeTestsMatching "org.scada_lts.web.security.XssUtilsTestsSuite"
         includeTestsMatching "org.scada_lts.web.mvc.api.validation.css.CssValidatorTestsSuite"
+        includeTestsMatching "org.scada_lts.web.beans.validation.xss.XssValidatorTestsSuite"
     }
 
     failFast = true
diff --git a/src/org/scada_lts/utils/SystemSettingsUtils.java b/src/org/scada_lts/utils/SystemSettingsUtils.java
index 39c630d47..5c9533a6d 100644
--- a/src/org/scada_lts/utils/SystemSettingsUtils.java
+++ b/src/org/scada_lts/utils/SystemSettingsUtils.java
@@ -75,6 +75,10 @@ private SystemSettingsUtils() {}
 
     private static final String CUSTOM_CSS_CONTENT_KEY = "systemsettings.custom.css.content";
 
+    private static final String SECURITY_HTTP_BODY_ACCESS_DENIED_REGEX_KEY = "scadalts.security.http.body.access.denied.regex";
+    private static final String SECURITY_HTTP_BODY_ACCESS_GRANTED_REGEX_KEY = "scadalts.security.http.body.access.granted.regex";
+    private static final String SECURITY_HTTP_BODY_PROTECT_ENABLED_KEY = "scadalts.security.http.body.protect.enabled";
+
     private static final org.apache.commons.logging.Log LOG = LogFactory.getLog(SystemSettingsUtils.class);
 
     public static DataPointSyncMode getDataPointSynchronizedMode() {
@@ -605,4 +609,32 @@ public static String getCustomCssContent() {
             return "";
         }
     }
+
+    public static String getSecurityHttpBodyAccessDeniedRegex() {
+        try {
+            return ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_BODY_ACCESS_DENIED_REGEX_KEY, "");
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return "";
+        }
+    }
+
+    public static String getSecurityHttpBodyAccessGrantedRegex() {
+        try {
+            return ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_BODY_ACCESS_GRANTED_REGEX_KEY, "");
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return "";
+        }
+    }
+
+    public static boolean isSecurityHttpBodyProtectEnabled() {
+        try {
+            String securityHttpQueryXssEnabled = ScadaConfig.getInstance().getConf().getProperty(SECURITY_HTTP_BODY_PROTECT_ENABLED_KEY, "false");
+            return Boolean.parseBoolean(securityHttpQueryXssEnabled);
+        } catch (Exception e) {
+            LOG.error(e.getMessage());
+            return false;
+        }
+    }
 }
diff --git a/src/org/scada_lts/web/beans/validation/xss/XssConstraintValidator.java b/src/org/scada_lts/web/beans/validation/xss/XssConstraintValidator.java
new file mode 100644
index 000000000..ce1069391
--- /dev/null
+++ b/src/org/scada_lts/web/beans/validation/xss/XssConstraintValidator.java
@@ -0,0 +1,21 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.scada_lts.serorepl.utils.StringUtils;
+import org.scada_lts.web.beans.validation.AbstractConstraintValidator;
+import org.scada_lts.web.beans.validation.ScadaValidator;
+
+public class XssConstraintValidator extends AbstractConstraintValidator<XssProtect, String> {
+
+    @Override
+    public void beforeValidate(String value) throws Exception {
+        if (StringUtils.isEmpty(value)) {
+            throw new XssValidatorException("Input is empty");
+        }
+    }
+
+    @Override
+    public void validate(String value) throws Exception {
+        ScadaValidator<String> validator = new XssValidator();
+        validator.validate(value);
+    }
+}
diff --git a/src/org/scada_lts/web/beans/validation/xss/XssProtect.java b/src/org/scada_lts/web/beans/validation/xss/XssProtect.java
new file mode 100644
index 000000000..c56362c59
--- /dev/null
+++ b/src/org/scada_lts/web/beans/validation/xss/XssProtect.java
@@ -0,0 +1,15 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import javax.validation.Constraint;
+import javax.validation.Payload;
+import java.lang.annotation.*;
+
+@Documented
+@Constraint(validatedBy = XssConstraintValidator.class)
+@Target({ElementType.METHOD, ElementType.FIELD, ElementType.ANNOTATION_TYPE, ElementType.PARAMETER})
+@Retention(RetentionPolicy.RUNTIME)
+public @interface XssProtect {
+    String message() default "Potential XSS detected in the request body.";
+    Class<?>[] groups() default {};
+    Class<? extends Payload>[] payload() default {};
+}
diff --git a/src/org/scada_lts/web/beans/validation/xss/XssValidator.java b/src/org/scada_lts/web/beans/validation/xss/XssValidator.java
new file mode 100644
index 000000000..9ab196479
--- /dev/null
+++ b/src/org/scada_lts/web/beans/validation/xss/XssValidator.java
@@ -0,0 +1,15 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.scada_lts.web.beans.validation.ScadaValidator;
+
+import static org.scada_lts.web.security.XssUtils.validateHttpBody;
+
+public class XssValidator implements ScadaValidator<String> {
+
+    @Override
+    public void validate(String input) throws XssValidatorException {
+        if(!validateHttpBody(input)) {
+            throw new XssValidatorException("Potential XSS attack detected");
+        }
+    }
+}
diff --git a/src/org/scada_lts/web/beans/validation/xss/XssValidatorException.java b/src/org/scada_lts/web/beans/validation/xss/XssValidatorException.java
new file mode 100644
index 000000000..e7cf8a61d
--- /dev/null
+++ b/src/org/scada_lts/web/beans/validation/xss/XssValidatorException.java
@@ -0,0 +1,25 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.scada_lts.web.beans.validation.ScadaValidatorException;
+
+public class XssValidatorException extends ScadaValidatorException {
+
+    public XssValidatorException() {
+    }
+
+    public XssValidatorException(String message) {
+        super(message);
+    }
+
+    public XssValidatorException(String message, Throwable cause) {
+        super(message, cause);
+    }
+
+    public XssValidatorException(Throwable cause) {
+        super(cause);
+    }
+
+    public XssValidatorException(String message, Throwable cause, boolean enableSuppression, boolean writableStackTrace) {
+        super(message, cause, enableSuppression, writableStackTrace);
+    }
+}
diff --git a/src/org/scada_lts/web/mvc/api/UserCommentAPI.java b/src/org/scada_lts/web/mvc/api/UserCommentAPI.java
index a8260fe59..5992f4992 100644
--- a/src/org/scada_lts/web/mvc/api/UserCommentAPI.java
+++ b/src/org/scada_lts/web/mvc/api/UserCommentAPI.java
@@ -7,12 +7,14 @@
 import org.scada_lts.mango.service.UserCommentService;
 import org.scada_lts.web.beans.ApplicationBeans;
 import org.scada_lts.web.mvc.api.json.JsonUserComment;
+import org.scada_lts.web.beans.validation.xss.XssProtect;
 import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Controller;
 import org.springframework.web.bind.annotation.*;
 
 import javax.servlet.http.HttpServletRequest;
+import javax.validation.Valid;
 
 import static org.scada_lts.utils.UserCommentApiUtils.validUserComment;
 import static org.scada_lts.utils.UserCommentApiUtils.validUserCommentWithTs;
@@ -41,7 +43,7 @@ public UserCommentAPI() {
      * @return Status
      */
     @PostMapping(value = "/{typeId}/{refId}")
-    public ResponseEntity<?> createUserComment(HttpServletRequest request, @RequestBody CreateUserComment createUserComment, @PathVariable("typeId") Integer typeId, @PathVariable("refId") Integer refId) {
+    public ResponseEntity<?> createUserComment(HttpServletRequest request, @Valid @RequestBody CreateUserComment createUserComment, @PathVariable("typeId") Integer typeId, @PathVariable("refId") Integer refId) {
         try {
             User user = Common.getUser(request);
             if(user != null) {
@@ -98,6 +100,8 @@ public ResponseEntity<String> deleteUserComment(HttpServletRequest request, @Pat
     }
 
     static class CreateUserComment {
+
+        @XssProtect
         private String commentText;
 
         public CreateUserComment() {
diff --git a/src/org/scada_lts/web/mvc/api/css/CssStyle.java b/src/org/scada_lts/web/mvc/api/css/CssStyle.java
index 0021b3f7f..cfe3b78f4 100644
--- a/src/org/scada_lts/web/mvc/api/css/CssStyle.java
+++ b/src/org/scada_lts/web/mvc/api/css/CssStyle.java
@@ -4,10 +4,11 @@
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import org.scada_lts.web.beans.validation.css.CssValid;
+import org.scada_lts.web.beans.validation.xss.XssProtect;
 
 public class CssStyle {
 
-    @CssValid
+    @CssValid @XssProtect
     private final String content;
 
     @JsonCreator(mode = JsonCreator.Mode.PROPERTIES)
diff --git a/src/org/scada_lts/web/security/XssUtils.java b/src/org/scada_lts/web/security/XssUtils.java
index c92f42392..71b1339ac 100644
--- a/src/org/scada_lts/web/security/XssUtils.java
+++ b/src/org/scada_lts/web/security/XssUtils.java
@@ -3,6 +3,7 @@
 import org.scada_lts.serorepl.utils.StringUtils;
 import org.scada_lts.utils.SystemSettingsUtils;
 
+import java.util.function.Predicate;
 import java.util.regex.Pattern;
 
 public final class XssUtils {
@@ -14,24 +15,42 @@ private XssUtils() {}
     public static final int SECURITY_HTTP_ACCESS_GRANTED_QUERY_LIMIT = SystemSettingsUtils.getSecurityHttpQueryLimit();
     public static final boolean SECURITY_HTTP_QUERY_PROTECT_ENABLED = SystemSettingsUtils.isSecurityHttpQueryProtectEnabled();
 
+    private static final Pattern SECURITY_HTTP_ACCESS_DENIED_BODY_REGEX = init(SystemSettingsUtils.getSecurityHttpBodyAccessDeniedRegex());
+    private static final Pattern SECURITY_HTTP_ACCESS_GRANTED_BODY_REGEX = init(SystemSettingsUtils.getSecurityHttpBodyAccessGrantedRegex());
+    public static final boolean SECURITY_HTTP_BODY_PROTECT_ENABLED = SystemSettingsUtils.isSecurityHttpBodyProtectEnabled();
+
     public static boolean validateHttpQuery(String query) {
+        return validate(query, SECURITY_HTTP_QUERY_PROTECT_ENABLED, q -> q.length() > SECURITY_HTTP_ACCESS_GRANTED_QUERY_LIMIT,
+                SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX, SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX);
+
+    }
+
+    public static boolean validateHttpBody(String body) {
+        return validate(body, SECURITY_HTTP_BODY_PROTECT_ENABLED, b -> false, SECURITY_HTTP_ACCESS_DENIED_BODY_REGEX,
+                SECURITY_HTTP_ACCESS_GRANTED_BODY_REGEX);
+    }
 
-        if(!SECURITY_HTTP_QUERY_PROTECT_ENABLED)
+    private static boolean validate(String input,
+                                    boolean protectEnabled,
+                                    Predicate<String> beforeCheckRegex,
+                                    Pattern accessDeniedRegex,
+                                    Pattern accessGrantedRegex) {
+        if(!protectEnabled)
             return true;
 
-        if (query == null || query.isEmpty()) {
+        if (input == null || input.isEmpty()) {
             return false;
         }
 
-        if(query.length() > SECURITY_HTTP_ACCESS_GRANTED_QUERY_LIMIT) {
+        if(beforeCheckRegex.test(input)) {
             return false;
         }
 
-        if(SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX != null && SECURITY_HTTP_ACCESS_DENIED_QUERY_REGEX.matcher(query).matches()) {
+        if(accessDeniedRegex != null && accessDeniedRegex.matcher(input).matches()) {
             return false;
         }
 
-        return SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX == null || SECURITY_HTTP_ACCESS_GRANTED_QUERY_REGEX.matcher(query).matches();
+        return accessGrantedRegex == null || accessGrantedRegex.matcher(input).matches();
     }
 
     private static Pattern init(String regex) {
diff --git a/test/env.properties b/test/env.properties
index be695d027..babfe1ba3 100644
--- a/test/env.properties
+++ b/test/env.properties
@@ -190,6 +190,12 @@ http.protocol.timeout-ms=15000
 event.assign.enabled=true
 
 scadalts.security.http.query.protect.enabled=true
-scadalts.security.http.query.limit=3900
+scadalts.security.http.query.limit=137
 scadalts.security.http.query.access.denied.regex=^(.*?(javascript:|onerror|onload|onmouseover|alert\\(){1}.*?)$
-scadalts.security.http.query.access.granted.regex=^(([a-zA-Z0-9_\\-]{1,32}=[a-zA-Z0-9_\\-.,/+=\s!$*?@%]*&?)|([a-zA-Z0-9_\\-]{1,32}&?))+$
\ No newline at end of file
+scadalts.security.http.query.access.granted.regex=^(([a-zA-Z0-9_\\-]{1,32}=[a-zA-Z0-9_\\-.,/+=\s!$*?@%]*&?)|([a-zA-Z0-9_\\-]{1,32}&?))+$
+
+systemsettings.custom.css.content=#top-description-container {\n\r\t\t\t\tdisplay: flex;\n\r\t\t\t\talign-items: flex-end;\n\r\t\t\t\tjustify-content: center;\n\r} \n\r\n\r#top-description-prefix { \n\r\t\t\t\tcolor: black !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tmargin-left: 0.5em !important;\n\r\t\t\t\tmargin-right: 0.5em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tvertical-align: bottom !important;\n\r\t\t\t\tline-height: 1 !important;\n\r} \n\r\n\r#top-description {\n\r\t\t\t\tcolor: #39B54A !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tline-height: 1 !important;\n\r}
+
+scadalts.security.http.body.protect.enabled=true
+scadalts.security.http.body.access.denied.regex=^(.*?((expression\\s*\\()|url\\s*\\(\\s*['\"]?javascript:|url\\s*\\(\\s*['\"]?data:|<script[^>]*>|</script>|<img[^>]+onerror=|@import\\s+url\\s*\\(\\s*['\"]?javascript:|<img[^>]*>|<script[^>]*>|<[^>]+>onerror\\s*=|onload\\s*=|eval\\s*\\(|alert\\s*\\(|onerror\\s*=|document.location){1}.*?)$
+scadalts.security.http.body.access.granted.regex=^([\\s\\S]*)$
\ No newline at end of file
diff --git a/test/org/scada_lts/web/beans/validation/xss/XssValidatorExceptionTest.java b/test/org/scada_lts/web/beans/validation/xss/XssValidatorExceptionTest.java
new file mode 100644
index 000000000..6a4d8a365
--- /dev/null
+++ b/test/org/scada_lts/web/beans/validation/xss/XssValidatorExceptionTest.java
@@ -0,0 +1,75 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.scada_lts.web.beans.validation.ScadaValidator;
+import org.scada_lts.web.beans.validation.ScadaValidatorException;
+
+import java.util.Arrays;
+import java.util.Collection;
+
+@RunWith(Parameterized.class)
+public class XssValidatorExceptionTest {
+
+    @Parameterized.Parameters(name = "{index}: input: {0}")
+    public static Collection<Object[]> data() {
+        return Arrays.asList(new Object[][]{
+                {null},
+                {""},
+                {"<script>alert(1)</script>"},
+                {"<a href=\"javascript:alert(1)\">Link</a>"},
+                {"<div onclick=\"alert(1)\">Click me</div>"},
+                {"body { background-image: url('\"><img src=x onerror=alert(document.location)>'); }"},
+                {"div { content: \"<script>alert('XSS')</script>\"; }"},
+                {"h1 { font-family: \"<img src=x onerror=alert('XSS')>\"; }"},
+                {"@import url(\"javascript:alert('XSS')\");"},
+                {"div { /* comment: <img src=x onerror=alert('XSS')> */ }"},
+                {"span { content: '\"><script>alert(1)</script>'; }"},
+                {"h2 { color: expression(alert('XSS')); }"},
+                {"\"><img src=x onerror=alert(document.location)>"},
+                {"<img src='x' onerror='alert(1)'>"},
+                {"<input type=\"text\" value=\"\" onfocus=\"alert(1)\">"},
+                {"<iframe src=\"javascript:alert(1)\"></iframe>"},
+                {"<form action=\"javascript:alert(1)\"><input type=\"submit\"></form>"},
+                {"<object data=\"javascript:alert(1)\"></object>"},
+                {"<embed src=\"javascript:alert(1)\">"},
+                {"<base href=\"javascript:alert(1)//\">"},
+                {"<svg onload=\"alert(1)\">"},
+                {"<svg><script>alert(1)</script></svg>"},
+                {"<math><a xlink:href=\"javascript:alert(1)\">XSS</a></math>"},
+                {"<img src=x onerror=\"alert(String.fromCharCode(88,83,83))\">"},
+                {"<b onmouseover=\"alert(1)\">XSS</b>"},
+                {"<video><source onerror=\"javascript:alert(1)\"></video>"},
+                {"<details open ontoggle=\"alert(1)\">"},
+                {"<input onfocus=\"alert('XSS')\">"},
+                {"<div style=\"width: expression(alert('XSS'))\">"},
+                {"<meta http-equiv=\"refresh\" content=\"0;url=javascript:alert(1)\">"},
+                {"<link rel=\"stylesheet\" href=\"javascript:alert(1)\">"},
+                {"<textarea onfocus=\"alert(1)\"></textarea>"},
+                {"<a href=\"//example.com\" onclick=\"alert(1)\">Link</a>"},
+                {"<button onclick=\"alert(1)\">Click me</button>"},
+                {"<div style=\"background-image: url(javascript:alert(1))\">XSS</div>"},
+                {"<audio src=\"javascript:alert(1)\"></audio>"},
+                {"<marquee onstart=\"alert(1)\">XSS</marquee>"},
+                {"<keygen autofocus onfocus=\"alert(1)\">"},
+                {"<command onclick=\"alert(1)\">Click me</command>"},
+                {"<img src=\"https://example.com/image.jpg\" alt=\"Example Image\" width=\"600\" height=\"400\" border=\"0\" />"},
+                {"<img src=\"http://example.com/image.jpg\" alt=\"Example Image\" width=\"600\" height=\"400\" border=\"0\" />"},
+                {"><img src=x onerror=alert(document.location)>"},
+        });
+    }
+
+    private final String input;
+    private final ScadaValidator<String> validator;
+
+    public XssValidatorExceptionTest(String input) {
+        this.input = input;
+        this.validator = new XssValidator();
+    }
+
+    @Test(expected = XssValidatorException.class)
+    public void when_isInvalidXss() throws ScadaValidatorException {
+        validator.validate(input);
+    }
+}
diff --git a/test/org/scada_lts/web/beans/validation/xss/XssValidatorTest.java b/test/org/scada_lts/web/beans/validation/xss/XssValidatorTest.java
new file mode 100644
index 000000000..1eb7857a5
--- /dev/null
+++ b/test/org/scada_lts/web/beans/validation/xss/XssValidatorTest.java
@@ -0,0 +1,55 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.scada_lts.web.beans.validation.ScadaValidator;
+import org.scada_lts.web.beans.validation.ScadaValidatorException;
+
+import java.util.Arrays;
+import java.util.Collection;
+
+@RunWith(Parameterized.class)
+public class XssValidatorTest {
+
+    @Parameterized.Parameters(name = "{index}: input: {0}")
+    public static Collection<Object[]> data() {
+        return Arrays.asList(new Object[][]{
+                {"<b>Bold</b>"},
+                {"Hello, World!"},
+                {"<i>Italic text</i>"},
+                {"<u>Underlined</u>"},
+                {"<strong>Strong text</strong>"},
+                {"<em>Emphasized text</em>"},
+                {"<p>Paragraph with <b>bold</b> and <i>italic</i></p>"},
+                {"<ul><li>Item 1</li><li>Item 2</li></ul>"},
+                {"<ol><li>First</li><li>Second</li></ol>"},
+                {"body { font-size: 14px; }"},
+                {"h1 { font-weight: bold; }"},
+                {"p { margin: 0; padding: 0; }"},
+                {"a > 12"},
+                {"a>12"},
+                {"a> 12"},
+                {"a >12"},
+                {"a<12"},
+                {"a < 12"},
+                {"a< 12"},
+                {"a <12"},
+                {"'a'"},
+                {"\"a\""},
+        });
+    }
+
+    private final String input;
+    private final ScadaValidator<String> validator;
+
+    public XssValidatorTest(String input) {
+        this.input = input;
+        this.validator = new XssValidator();
+    }
+
+    @Test
+    public void when_isInvalidXss() throws ScadaValidatorException {
+        validator.validate(input);
+    }
+}
diff --git a/test/org/scada_lts/web/beans/validation/xss/XssValidatorTestsSuite.java b/test/org/scada_lts/web/beans/validation/xss/XssValidatorTestsSuite.java
new file mode 100644
index 000000000..70baf1b9e
--- /dev/null
+++ b/test/org/scada_lts/web/beans/validation/xss/XssValidatorTestsSuite.java
@@ -0,0 +1,12 @@
+package org.scada_lts.web.beans.validation.xss;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+        XssValidatorTest.class,
+        XssValidatorExceptionTest.class
+})
+public class XssValidatorTestsSuite {
+}
\ No newline at end of file
diff --git a/test/org/scada_lts/web/security/BodyXssUtilsTest.java b/test/org/scada_lts/web/security/BodyXssUtilsTest.java
new file mode 100644
index 000000000..c475d210d
--- /dev/null
+++ b/test/org/scada_lts/web/security/BodyXssUtilsTest.java
@@ -0,0 +1,160 @@
+package org.scada_lts.web.security;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.Parameterized;
+import org.junit.runners.Parameterized.Parameters;
+
+import java.util.Arrays;
+import java.util.Collection;
+
+import static org.junit.Assert.assertEquals;
+
+@RunWith(Parameterized.class)
+public class BodyXssUtilsTest {
+
+    private final String input;
+    private final boolean expectedResult;
+
+    public BodyXssUtilsTest(String input, boolean expectedResult) {
+        this.input = input;
+        this.expectedResult = expectedResult;
+    }
+
+    @Parameters(name = "{index}: input: {0}, expectedResult: {1}")
+    public static Collection<Object[]> data() {
+        return Arrays.asList(new Object[][]{
+
+                // Test for a legitimate Query
+                {"validUser", true},
+                {"123", true},
+
+                // Tests for queries containing banned patterns.
+                {"javascript:alert(1)", false},
+                {"onerror=alert(1)", false},
+                {"<script>alert(1)</script>", false},
+                {"onload=alert(1)", false},
+                {"onmouseover=alert(1)", false},
+                {"%6A%61%76%61%73%63%72%69%70%74", true},
+
+                // Borderline cases
+                {"=&", true},
+                {"a”.repeat(33)", true},
+                {"invalid!key", true},
+                {"validKey", true},
+                {"onerror=alert(1)&onload=alert(1)", false},
+                {"!key=value", true},
+
+
+                {"abc", true},
+                {"ABC", true},
+                {"abc=abc", true},
+                {"ABC=ABC", true},
+                {"abc=abc&ABC=ABC", true},
+                {"ABC=ABC&abc=abc", true},
+                {"abc=1", true},
+                {"ABC=1", true},
+                {"param123", true},
+                {"param1&param2=23", true},
+                {"param1=12&param2", true},
+                {"param1=12&param2&param3", true},
+                {"param1", true},
+                {"startTs=123", true},
+                {"startTs=1724326168402&endTs=1724329768507", true},
+                {"startTs=123.", true},
+                {"startTs=12345678901234567890123456789012", true},
+                {"startTs=123456789012345678901234567890123", true},
+                {"12345678901234567890123456789012=abc", true},
+                {"123456789012345678901234567890123=abc", true},
+                {"startTs=1724326168402&endTs=1724329768507&ids=101,70,97,84&configFromSystem=false&enabled=false&valuesLimit=10000&limitFactor=1", true},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=100", true},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=1005", true},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=100&abc=12", true},
+                {"abc=", true},
+
+                {"", false},
+                {null, false},
+                {"&param1", true},
+                {"&param1&param2", true},
+                {"&param1=123&param2", true},
+                {"&param1&param=123", true},
+                {"param1&param2=23&onerror", true},
+                {"param1&param2=23onerror", true},
+                {"param1&param2=23&onerror=", false},
+                {"param1&param2=23onerror=", false},
+                {"para!m1", true},
+                {"onerror=alert(1)", false},
+                {"onload=alert(1)", false},
+                {"onerror=abc", false},
+                {"onload=abc", false},
+                {"onload=", false},
+                {"onerror=", false},
+                {"onload =", false},
+                {"onerror =", false},
+                {"onload    =", false},
+                {"onerror   =", false},
+                {"onload", true},
+                {"onerror", true},
+                {"!param1=value", true},
+                {"<img src=x onerror=alert(document.location)>", false},
+                {"param1=<img src=x onerror=alert(document.location)>", false},
+                {"param1=<img src=x onerror=alert(document.location)>&param2=123", false},
+                {"param1=123&param2=<img src=x onerror=alert(document.location)>", false},
+                {"param1=123&param2=<img src=x onerror=document.location>", false},
+                {"param1=alert(document.location)", false},
+                {"=abc", true},
+                {"param1=<script>alert(document.location)", false},
+                {"param1=<scriptalert(document.location)", false},
+                {"param1=script>alert(document.location)", false},
+                {"param1=alert(document.location)</script>", false},
+                {"param1=alert(document.location)/script>", false},
+                {"param1=alert(document.location)</script", false},
+                {"param1=<script>document.location", false},
+                {"param1=<scriptdocument.location", false},
+                {"param1=script>document.location", false},
+                {"param1=document.location</script>", false},
+                {"param1=document.location/script>", false},
+                {"param1=document.location</script", false},
+                {"#top-description-container {\n" +
+                        "    display: flex;\n" +
+                        "    align-items: flex-end;\n" +
+                        "    justify-content: center;\n" +
+                        "} \n" +
+                        "\n" +
+                        "#top-description-prefix { \n" +
+                        "    color: red !important;\n" +
+                        "    font-size: 2em !important;\n" +
+                        "    margin-left: 0.5em !important;\n" +
+                        "    margin-right: 0.5em !important;\n" +
+                        "    display: inline-block !important;\n" +
+                        "    vertical-align: bottom !important;\n" +
+                        "    line-height: 1 !important;\n" +
+                        "} \n" +
+                        "\n" +
+                        "#top-description {\n" +
+                        "    color: #39B54A !important;\n" +
+                        "    font-size: 2em !important;\n" +
+                        "    display: inline-block !important;\n" +
+                        "    line-height: 1 !important; \n" +
+                        "}", true},
+                {"#top-description-container {\n" +
+                        "    display: flex;\n" +
+                        "    align-items: flex-end;\n" +
+                        "    justify-content: center;\n" +
+                        "}", true},
+                {"#top-description-container {\n" +
+                        "    display: flex;\n" +
+                        "}", true}
+        });
+    }
+
+    @Test
+    public void testValidate() {
+
+        //when:
+        boolean result = XssUtils.validateHttpBody(input);
+
+        //then:
+        assertEquals("Validation Body failed for input: " + input, expectedResult, result);
+    }
+}
diff --git a/test/org/scada_lts/web/security/XssUtilsTest.java b/test/org/scada_lts/web/security/XssUtilsTest.java
index 00902cfbe..3412c4f37 100644
--- a/test/org/scada_lts/web/security/XssUtilsTest.java
+++ b/test/org/scada_lts/web/security/XssUtilsTest.java
@@ -68,6 +68,8 @@ public static Collection<Object[]> data() {
                 {"123456789012345678901234567890123=abc", true},
                 {"startTs=1724326168402&endTs=1724329768507&ids=101,70,97,84&configFromSystem=false&enabled=false&valuesLimit=10000&limitFactor=1", true},
                 {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=100", true},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=1005", false},
+                {"projectName=sagadf&includePointValues=true&includeUploadsFolder=true&includeGraphicsFolder=true&projectDescription=&pointValuesMaxZip=100&abc=12", false},
                 {"abc=", true},
 
                 {"", false},
@@ -78,6 +80,8 @@ public static Collection<Object[]> data() {
                 {"&param1&param=123", false},
                 {"param1&param2=23&onerror", false},
                 {"param1&param2=23onerror", false},
+                {"param1&param2=23&onerror=", false},
+                {"param1&param2=23onerror=", false},
                 {"para!m1", false},
                 {"onerror=alert(1)", false},
                 {"onload=alert(1)", false},
@@ -85,6 +89,10 @@ public static Collection<Object[]> data() {
                 {"onload=abc", false},
                 {"onload=", false},
                 {"onerror=", false},
+                {"onload =", false},
+                {"onerror =", false},
+                {"onload    =", false},
+                {"onerror   =", false},
                 {"onload", false},
                 {"onerror", false},
                 {"!param1=value", false},
@@ -107,6 +115,36 @@ public static Collection<Object[]> data() {
                 {"param1=document.location</script>", false},
                 {"param1=document.location/script>", false},
                 {"param1=document.location</script", false},
+                {"#top-description-container {\n" +
+                "    display: flex;\n" +
+                "    align-items: flex-end;\n" +
+                "    justify-content: center;\n" +
+                "} \n" +
+                "\n" +
+                "#top-description-prefix { \n" +
+                "    color: red !important;\n" +
+                "    font-size: 2em !important;\n" +
+                "    margin-left: 0.5em !important;\n" +
+                "    margin-right: 0.5em !important;\n" +
+                "    display: inline-block !important;\n" +
+                "    vertical-align: bottom !important;\n" +
+                "    line-height: 1 !important;\n" +
+                "} \n" +
+                "\n" +
+                "#top-description {\n" +
+                "    color: #39B54A !important;\n" +
+                "    font-size: 2em !important;\n" +
+                "    display: inline-block !important;\n" +
+                "    line-height: 1 !important; \n" +
+                "}", false},
+                {"#top-description-container {\n" +
+                        "    display: flex;\n" +
+                        "    align-items: flex-end;\n" +
+                        "    justify-content: center;\n" +
+                        "}", false},
+                {"#top-description-container {\n" +
+                        "    display: flex;\n" +
+                        "}", false}
         });
     }
 
diff --git a/test/org/scada_lts/web/security/XssUtilsTestsSuite.java b/test/org/scada_lts/web/security/XssUtilsTestsSuite.java
new file mode 100644
index 000000000..aba3d12ed
--- /dev/null
+++ b/test/org/scada_lts/web/security/XssUtilsTestsSuite.java
@@ -0,0 +1,12 @@
+package org.scada_lts.web.security;
+
+import org.junit.runner.RunWith;
+import org.junit.runners.Suite;
+
+@RunWith(Suite.class)
+@Suite.SuiteClasses({
+        XssUtilsTest.class,
+        BodyXssUtilsTest.class
+})
+public class XssUtilsTestsSuite {
+}
\ No newline at end of file
diff --git a/webapp-resources/env.properties b/webapp-resources/env.properties
index 00c3f7ed8..5963af69e 100644
--- a/webapp-resources/env.properties
+++ b/webapp-resources/env.properties
@@ -192,4 +192,8 @@ scadalts.security.http.query.limit=3900
 scadalts.security.http.query.access.denied.regex=^(.*?(script>|<script|/script>|</script|javascript:|onerror|onload|onmouseover|alert\\(){1}.*?)$
 scadalts.security.http.query.access.granted.regex=^(([a-zA-Z0-9_\\-]{1,32}=[a-zA-Z0-9_\\-.,/+=\s!$*?@%]*&?)|([a-zA-Z0-9_\\-]{1,32}&?))+$
 
-systemsettings.custom.css.content=#top-description-container {\n\r\t\t\t\tdisplay: flex;\n\r\t\t\t\talign-items: flex-end;\n\r\t\t\t\tjustify-content: center;\n\r} \n\r\n\r#top-description-prefix { \n\r\t\t\t\tcolor: black !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tmargin-left: 0.5em !important;\n\r\t\t\t\tmargin-right: 0.5em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tvertical-align: bottom !important;\n\r\t\t\t\tline-height: 1 !important;\n\r} \n\r\n\r#top-description {\n\r\t\t\t\tcolor: #39B54A !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tline-height: 1 !important;\n\r}
\ No newline at end of file
+systemsettings.custom.css.content=#top-description-container {\n\r\t\t\t\tdisplay: flex;\n\r\t\t\t\talign-items: flex-end;\n\r\t\t\t\tjustify-content: center;\n\r} \n\r\n\r#top-description-prefix { \n\r\t\t\t\tcolor: black !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tmargin-left: 0.5em !important;\n\r\t\t\t\tmargin-right: 0.5em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tvertical-align: bottom !important;\n\r\t\t\t\tline-height: 1 !important;\n\r} \n\r\n\r#top-description {\n\r\t\t\t\tcolor: #39B54A !important;\n\r\t\t\t\tfont-size: 2em !important;\n\r\t\t\t\tdisplay: inline-block !important;\n\r\t\t\t\tline-height: 1 !important;\n\r}
+
+scadalts.security.http.body.protect.enabled=true
+scadalts.security.http.body.access.denied.regex=^(.*?((expression\\s*\\()|url\\s*\\(\\s*['\"]?javascript:|url\\s*\\(\\s*['\"]?data:|<script[^>]*>|</script>|<img[^>]+onerror=|@import\\s+url\\s*\\(\\s*['\"]?javascript:|<img[^>]*>|<script[^>]*>|<[^>]+>onerror\\s*=|onload\\s*=|eval\\s*\\(|alert\\s*\\(|onerror\\s*=|document.location){1}.*?)$
+scadalts.security.http.body.access.granted.regex=^([\\s\\S]*)$
\ No newline at end of file