OK So I've concluded that it's impossible to restrict the parameters that are going into an included page, at least not without a bit of programming. If you really need this and you're not afraid of a bit of programming, do this:
Make yourself a class called CustomRequest that implements HttpServletRequest. In the constructor, pass in your request object and the new parameters you want as a Hashtable. In all the many many methods that you have to implement, simply call the request object's method on that method, except for the getParameter... methods where
you should return values from your own hashtable. Make one more public static method called "include" that takes as parameters: request, response, out, the filename to include, an array of new parameter names, and an array of parameter values.
Then in this "include" method, do this:
1. flush out
2. pack your parameters from the arrays into a hashtable called params.
3. construct the uri of the include file, based on request.getRequestURI() and the filename passed in. Call it uri.
4. run the following lines of code
HttpServletRequest customRequest = new CustomRequest(request, params);
request.getRequestDispatcher(uri).include(customRequest, response);
In your jsp, call it like this:
Please don't ask me for the code; it's copywrited out of my control. And I'm going to stop monitoring this
thread, so have a nice day.
