How to HTML-encode in the JSP expression language?

问题

Consider the following piece of JSP:

<param name="FlashVars" value="${flashVars}" />

The value of ${flashVars} contains ampersands and needs to be encoded before it is output. Instead, JSP expects the value of ${flashVars} to be a piece of HTML and outputs the ampersands verbatim, resulting in bad HTML.

I found out that I can get the value to be encoded if I write it like this:

<param name="FlashVars" value="<c:out value="${flashVars}"/>" />

But this looks really ugly and confuses my IDE to boot. Is there a better way to get the same result?

回答1:

Use fn:escapeXml().

<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
...
<param name="FlashVars" value="${fn:escapeXml(flashVars)}" />

来源：https://stackoverflow.com/questions/4526502/how-to-html-encode-in-the-jsp-expression-language