Question

I have html in my db, would like it to be editable in a text area in the CSR/ admin page.

Using java/ jsp would like to know if the following are a good way/ is there a better:
1. apache commons StringEscapeUtils to encode the data being sent to the browser. Plan to write out the string as a java script variable and then decode it and set it to the textarea’s value. Want to do this so if a user enters
as part of the value it does not close the textarea the next time its edited.

2. what do i use to unescape the data from StringEscapeUtils? (in javascript so the user sees the html and can edit in the textarea)

3. am i better of writing a simple replaceall using String to replace characters < > ? and then javascript to string functions to unescape them again ? If so do I need to unescape any other characters?

Any other pointers will be great.

Using java 6 with jboss 4.2 Will take care of the collation / format in db saw other threads about that.

UPDATE:
Ended up using this – can be improved

public static String screenHtmlShow(String s){
    s= s.replace("<","< ");
    s= s.replace("/>","/ >");
    s= s.replace("\n"," ");
    s= s.replace("\r"," ");
    s= s.replace("\"","'");
    return s;
}

Answer 1

You could use <c:out value="${value}"/> on the JSP page. It has an attribute escapeXml=true/false which could be useful as well.