How to HTML-encode in the JSP expression language?

java jsp el html-encode
Martijn picture Martijn · Dec 24, 2010 · Viewed 19.7k times · Source

Consider the following piece of JSP:

<param name="FlashVars" value="${flashVars}" />

The value of ${flashVars} contains ampersands and needs to be encoded before it is output. Instead, JSP expects the value of ${flashVars} to be a piece of HTML and outputs the ampersands verbatim, resulting in bad HTML.

I found out that I can get the value to be encoded if I write it like this:

<param name="FlashVars" value="<c:out value="${flashVars}"/>" />

But this looks really ugly and confuses my IDE to boot. Is there a better way to get the same result?

Answer

BalusC picture BalusC · Dec 24, 2010

Use fn:escapeXml().

<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
...
<param name="FlashVars" value="${fn:escapeXml(flashVars)}" />

Related questions

Use JSTL forEach loop's varStatus as an ID

I want to use the count from the JSTL forEach loop, but my code doesnt seem to work. <c:forEach items="${loopableObject}" var="theObject" varStatus="theCount"> <div id="divIDNo${theCount}"> </div> </c:forEach&…

Read More
How to check a boolean condition in EL?

Is this correct? <c:if test="${theBooleanVariable == false}">It's false!</c:if> Or could I do this? <c:if test="${!theBooleanVariable}">It's false!</c:if>

Read More
What does this expression language ${pageContext.request.contextPath} exactly do in JSP EL?

I have a web app, where I have different navigation anchor tags such as Home, Profile and etc. What I want: When I press anchor tags like home or profile. I just want to ensure that current user gets its …

Read More