CODEWITHSUNDEEP
htmlxmljspescaping
eugenn
eugenn

Reputation: 1647

What is the difference between escapeXml and escapeHtml?

I would like to escape characters in JSP pages. Which is more suitable, escapeXml or escapeHtml?

Upvotes: 18

Views: 44712

Answers (4)

Justin Niessner
Justin Niessner

Reputation: 245429

Since you are sending HTML back to the consumer I would go with escapeHtml.

escapeXml only supports escaping the five basic XML entities (gt, lt, quot, amp, apos) whereas escapeHtml supports escaping all known HTML 4.0 entities.

Upvotes: 1

BalusC
BalusC

Reputation: 1108732

There's no such thing as escapeHtml in JSP. You normally use <c:out escapeXml="true"> (it by the way already defaults to true, so you can omit it) or fn:escapeXml() to escape HTML in JSP.

E.g.

<c:out value="Welcome, ${user.name}" />
<input name="foo" value="${fn:escapeXml(param.foo)}" />

It will escape them as XML entities which works perfectly fine in plain HTML as well. They are only literally called XML entities because HTML entities are invalid in XML.

See also:

Upvotes: 19

Rudu
Rudu

Reputation: 15892

They're designed for different purposes, HTML has lots of entities that XML doesn't. XML only has 5 escapes:

&lt; represents "<"
&gt; represents ">"
&amp; represents "&"
&apos; represents '
&quot; represents "

While HTML has loads - think of &nbsp; &copy; etc. These HTML codes aren't valid in XML unless you include a definition in the header. The numeric codes (like &#169; for the copyright symbol) are valid in both.

Upvotes: 20

Jon Freedman
Jon Freedman

Reputation: 9697

Assuming you're referring to commons StringEscapeUtils, escapeXml only deals with <>"'& while escapeHtml covers a richer set of characters.

Upvotes: 1

Related Questions