DataTables ↔ Server‑Side REST API: Integer Record Counts and Cell Escaping

Answer

DataTables does not strictly validate recordsTotal and recordsFiltered as integers, and the escape option defaults to true for cell data. That means type mismatches are not rejected, they are used as-is, and XSS protection for server-supplied content relies on the default HTML escaping unless you disable it.

Confirmed facts

• DataTables 1.10+ uses the raw value returned in the JSON for recordsTotal and recordsFiltered. No schema validation or type coercion is performed by the core. The values are inserted into the info string and used in pagination math via JavaScript loose typing.
• The column data escape setting defaults to true in all builds, including serverSide:true. With escape:true DataTables HTML-escapes cell strings before DOM insertion.
• escape:false disables automatic escaping. When disabled, responsibility for sanitisation moves to the server or to a render function.

Likely explanation and practical impact

Because validation is absent, a non-integer such as a string "100", null, or an object will not throw a JavaScript error. It will typically be rendered verbatim in the info text, e.g., "Showing 1 to 10 of [object Object] entries", and arithmetic for paging can produce NaN or incorrect page counts. This is a silent UI bug rather than a warning.

With escape:true the default, untrusted HTML from the server is escaped to text nodes, which mitigates reflected XSS for plain cell data. It does not guarantee full XSS safety: it does not protect against data injected via render functions, column.type rendering, or when escape is turned off.

Steps needed for this integration

1. Ensure the REST API returns recordsTotal and recordsFiltered as JSON numbers, not strings. Verify with console.log($.fn.dataTable.version) and a test response.
2. Keep escape at its default true unless you intentionally need HTML rendering. If HTML is required, sanitize on the server and use a render function with explicit allow-list.
3. Test edge cases: return recordsTotal as a string "100" and as a non-numeric object, confirm info text changes and pagination behaves unexpectedly.
4. Test XSS mitigation: return a cell value "". With default settings it should appear escaped in the DOM. Set column.defaults.escape = false to confirm unescaped rendering.

Assumption: DataTables 1.10+ and jQuery build. Behavior is consistent from 1.10 onward. If you are on a pre-1.10 legacy build, defaults and escaping behavior differ and need separate verification.