1

I have read that using <c:out> tag will prevent XSS attacks but for some cases, say for example, displaying units with superscript (kg/m3) using <c:out> is displayed as plain text with sup tag (kg/m<sup>3</sup>). In order to display it properly, escapeXml="false" has to be used. 

<c:out value="${units}" escapeXml="false></c:out>

But I was wondering whether using <c:out> tag with escapeXml="false" is equivalent to not using <c:out> tag itself?

BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
xxxxx
  • 1,918
  • 2
  • 17
  • 22

1 Answers1

1
<c:out value="${units}" escapeXml="false" />

This is indeed equivalent to not using <c:out>, but only in JSP 2.0 or newer.

${units}

In older JSP versions (JSP 1.x), EL in template text like above was not supported and therefore <c:out> was the only way to print EL expressions.

See also:

Community
  • 1
  • 1
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555