Question

I’m looking for an alternative to PHP’s htmlspecialchars() or even better, for a global solution using Spring MVC. For example, it would be great if data passed from Controller to View using ModelAndView or ModelMap was automatically processed so I could be sure that I’m working with safe strings inside jsp View.

Answer 1

If you’re using JSPs to display your data, all you need to do is use the JSTL’s <c:out> tag, or fn:escapeXml() function to escame the HTML special chars:

Last Name : <c:out value="${someBean.lastName}"/>
First Name : ${fn:escapeXml(someBean.firstName)}

I would definitely not do this in the controller. This is one of the view’s jobs.