code: public static void secureParamsTagAction(ServletRequest request, String allowXml, String allowHtml, String policy) {
  
          if (request instanceof CmsFlexRequest) {
              CmsFlexRequest flexRequest = (CmsFlexRequest)request;
              CmsObject cms = CmsFlexController.getCmsObject(flexRequest);
              List<String> exceptions = Collections.emptyList();
              if (allowXml != null) {
                  exceptions = CmsStringUtil.splitAsList(allowXml, ",");
              }
              flexRequest.enableParameterEscaping();
              flexRequest.getParameterEscaper().setExceptions(exceptions);
              Set<String> allowHtmlSet = Collections.emptySet();
              if (allowHtml != null) {
                  allowHtmlSet = new HashSet<String>(CmsStringUtil.splitAsList(allowHtml, ","));
                  flexRequest.getParameterEscaper().enableAntiSamy(cms, policy, allowHtmlSet);
              }
          }
      }
docs: Static method which provides the actual functionality of this tag.<p>
  
  @param request the request for which the parameters should be escaped
  
  @param allowXml the comma-separated list of parameters for which XML characters will not be escaped
  @param allowHtml the comma-separated list of parameters for which HTML will be allowed, but be escaped
  @param policy  the site path of an AntiSamy policy file