Question

I’ve got a variable in JSTL and would like to replace all commas with

<c:set var="colTxt" value="${fn:replace(colTxt,',','<br />')}" />

This however shows the error:

The value of attribute ‘value’ associated with an element type “c:set” must not contain the ‘<‘ character

What can I do about this?

Answer 1

Use < and > instead of < and >.

When printing it using <c:out>, then ensure that you add escapeXml="false", otherwise you’ll see <br /> literally showing as-is instead of being parsed as a real HTML linebreak.

However, when ${colTxt} contains user-controlled input, then disabling XML escaping might potentially create a XSS hole. You might want to solve the problem differently, e.g.

<c:forEach items="${fn:split(colTxt, ',')}" var="item">
    <c:out value="${item}" /><br />
</c:forEach>