JSENCODE
Encode text strings and merge field values for use in JavaScript by inserting an escape character, such as a backslash (), before unsafe JavaScript characters, such as an apostrophe (‘).
The JavaScript runs when the page loads and displays the alert.
<script>var ret = "foo";alert('xss');//";</script>In this case, use the JSENCODE function to prevent JavaScript from being executed. Example
<script>var ret = "{!JSENCODE($CurrentPage.parameters.retURL)}";</script>