Double Quotes

[Deepan Ignatius]

Hi,

I have the following prece of JSP code where I am trying to access a hashMap varaible present in session scope and try to create as many as hidden variables possible.

	 <c:forEach var="entry" items="${sessionScope.hashProductNameIds}">							
	      <input type="hidden" name="${entry.key}" value="${entry.value}" />
	 </c:forEach>

Problem : When the ${entry.key} has double quotes as part of its value then it is rendered differently.
Ex:

if the key is abc"def and value is 33 then a hidden variable should be created with the key abc"def and value as 33 but created as key abc and value as 33.

Although this could be resolved by changing the 2nd line of code to
<input type='hidden' name='${entry.key}' value='${entry.value}' />

Is there a better solution to this?

Thanks

[Bear Bibeault]

The internal quotes need to be encoded.

[Deepan Ignatius]

could you help me how to do this?

[Stefan Evans]

You need to replace quotes in your key/value with "&quot;" so that it renders as a quote in html, without disturbing the quotes you are putting the value in.
Quite possibly the JSTL replace function would do the trick

<%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%>
${fn:replace(entry.key, "\"", "&quot;")}

Using a framework such as struts/stripes etc will normally do this sort of thing for you as well.

[Bear Bibeault]

Or simply use <c:out> or ${fn:escapeXml()}

[Stefan Evans]

Yeah. Do that. Thats even easier.
Serves me right to try and answer a question before properly waking up. Somehow I got the thought that it wouldn't escape things properly, but thats dealing with javascript strings, which are an entirely different kettle of fish.

[Deepan Ignatius]

Thanks for your suggesstions.

I tried to use <c:out> and below is the piece of code which I changed

before:

<input type="hidden" name="${entry.key}" value="${entry.value}"/>

after:

<input type="hidden" name=<c:out value="${entry.key}" escapeXml="false"/> value=<c:out value="${entry.value}" escapeXml="false"/> />

Even with this, the hidden varaibles are not created properly.

ex:-
if the entry.key contains any double quotes say Nok"123 then hidden varaible is created with the name Nok and not Nok"123 which is what I am trying to do.

[Bear Bibeault]

That's because your HTML is sloppy. Always quote attribute values. This has nothing at all to do with JSP.

[Stefan Evans]

It might have something to do with the fact that you have specified escapeXml as false !?!?!?
Escaping the XML is the whole point of using this tag!!! That's what will convert the " to &quot;
Also Bear's comment about quotes is also relevant.
I would use single quotes in this case. Some parsers have trouble with 'nested' double quotes even if the quotes in question are in a seperate tag.

<input type="hidden" name='<c:out value="${entry.key}"/>' value='<c:out value="${entry.value}"/>' /> 

[Bear Bibeault]

Stefan Evans wrote:It might have something to do with the fact that you have specified escapeXml as false !?!?!?

That too!