How to escape double quotes in JSTL function / EL?

Question

I need to change \" to \\\" with JSTL replace function to use the string in input tag like:

Answer 1

It doesn't work because the \ is an escape character in Java string. To represent it literally, you need to escape it with another \ again. Also the " is a special character in EL, you also need to escape it to represent it literally. So, the proper syntax would have been:

But, you should actually be using fn:escapeXml() to prevent XSS. It not only escapes quotes, but also other characters.

See also:

• XSS prevention in JSP/Servlet web application