Question on escapeXml attribute in c:out

[Sangeetha Raja]

In JSTL spec I could find the descrition for escapeXml of <c: out>

    
<c:out value=”value” [escapeXml=”{true|false}”]>
default value
</c:out>

Deterrmines whether characters <,>,&,’,” in the
resulting string should be converted to their
corresponding character entity codes. Default value is
true

What is Convertion of character entity code? what would happen if the conversion didnt occur? Can anyone of you give more detail on this?

[Bauke Scholtz]

Try it yourself.

<c:out value="<script>alert('xss')</script>" escapeXml="false" />

<c:out value="<script>alert('xss')</script>" escapeXml="true" />

[Bear Bibeault]

Excellent learning example.

[Sangeetha Raja]

Thanks it helps