Question

I have app engine app that uses a java servlet to save a message to the datastore that is posted by a user (using a form).

String content = req.getParameter("message");
message.setProperty("content", content);

When later processing the message in JSP I get a run-time error if the user has hit “enter” when typing the message.

messageArray[<%=i%>]= {
                    content:  "<%=message.getProperty("content")%>",

How do I solve this? I would like to save the “enter” to display the message properly.

Thanks!

Answer 1

You’re going to have to use something like JSON encoding to make the string safe for inclusion into JavaScript source. You should do that anyway to prevent an obvious XSS attack.

JavaScript doesn’t allow raw newlines in string constants. If you wanted to you could create your own EL function to sanitize the string, converting non-printable characters to \uXXXX escapes, and making sure that embedded quotes are preceded by a backslash.