Option B inserts an unescaped merge expression directly into a JavaScript block, enabling malicious data in Account.Name to break out of the string literal and execute arbitrary script (ref. Security Guide, “Protect Against XSS”). Expressions rendered inside <script> tags must be wrapped with JSENCODE/HTMLENCODE or assigned through apex:outputText with escape=”true”; failing to do so is a documented XSS vulnerability.

A Apex outputText escapes HTML by default, so Account.Name is encoded—no XSS risk.

C Explicit HTMLENCODE() guarantees the value is safely rendered, removing injection vectors.

D JSENCODE() correctly escapes characters for JavaScript contexts, blocking script-breaking characters.

1. Salesforce Security Implementation Guide, “Visualforce and XSS”, §“Escape Output in JavaScript”, Winter ’24, p.167–169.

2. Visualforce Developer Guide, “escape attribute of ”, p.487.