How to escape double quotes in JSTL function / EL?

java jstl el
Sanghyun Lee picture Sanghyun Lee · Aug 18, 2011 · Viewed 48.1k times · Source

I need to change " to \" with JSTL replace function to use the string in input tag like:

<input type="hidden" name="text" size="40" value="${text}">

If the ${text} has the ", the HTML will be broken.

So I tried

<input type="hidden" name="text" size="40" value="${fn:replace(text, "\"", "\\\""}">

and

<input type="hidden" name="text" size="40" value="${fn:replace(text, '"', '\"'}">

but didn't worked. The page makes errors like

org.apache.el.parser.ParseException: Encountered " "}" "} "" at line 1, column 32. Was expecting one of: "." ... ")" ... "[" ... "," ... ">" ... "gt" ... "<" ... "lt" ... ">=" ... "ge" ... "<=" ... "le" ... "==" ... "eq" ... "!=" ... "ne" ... "&&" ... "and" ... "||" ... "or" ... "*" ... "+" ... "-" ... "/" ... "div" ... "%" ... "mod" ...

How can I do this?

Update

I missed a close paren of replace function. The right one was this one with a close paren:

<input type="hidden" name="text" size="40" value="${fn:replace(text, '"', '\"')}">

Update2

I found out that when posting texts, using \ is not a good idea because of this reason why can't use \" in HTML input tag?. The code should be like this:

<input type="hidden" name="text" size="40" value="${fn:replace(text, '"', '&quot;')}">

Answer

BalusC picture BalusC · Aug 18, 2011

It doesn't work because the \ is an escape character in Java string. To represent it literally, you need to escape it with another \ again. Also the " is a special character in EL, you also need to escape it to represent it literally. So, the proper syntax would have been:

<input type="hidden" name="text" size="40" value="${fn:replace(text, '\"', '\\\"'}">

But, you should actually be using fn:escapeXml() to prevent XSS. It not only escapes quotes, but also other characters.

<input type="hidden" name="text" size="40" value="${fn:escapeXml(text)}">

See also:

Related questions

Use JSTL forEach loop's varStatus as an ID

I want to use the count from the JSTL forEach loop, but my code doesnt seem to work. <c:forEach items="${loopableObject}" var="theObject" varStatus="theCount"> <div id="divIDNo${theCount}"> </div> </c:forEach&…

Read More
EL access a map value by Integer key

I have a Map keyed by Integer. Using EL, how can I access a value by its key? Map<Integer, String> map = new HashMap<Integer, String>(); map.put(1, "One"); map.put(2, "Two"); map.put(3, "Three"); I …

Read More
How do you get the length of a list in the JSF expression language?

How would I get the length of an ArrayList using a JSF EL expression? #{MyBean.somelist.length} does not work.

Read More