Question

The code I’m working with looks something like this:

        <% MessageInfo msg= hp.getInfo(transactionName, checkpointLoc);%>
    <form name='editinfo' action="/editmessage.jsp" method="post">
                <table align=center colspan = "3">
                    <tr>
                        <td><u><b>Currently Editing:</b></u></td>
                    </tr>
                    <tr>
                        <td>Name:</td>
                        <td><input type="text" name="tname" style="width:254px" value=<%= msg.getName() %>/></td>
                        <td><%= msg.getName()%></td>
                    </tr>
                    <tr>
                        <td>Search Method:</td>
                        <td><input type="text" name="searchmethod" style="width:254px" value=<%=msg.getSearchMethod() %>/></td>
                    </tr>
</table>
</form>

Right now, it’s displaying oddly in the text boxes.

In the first text box, it is only displaying the first word of the string its supposed to be displaying, but when I do not place the string in a text box, the full string is displayed. For example if “Hello world” was to be displayed, “Hello” would be the only thing displayed in the text box.

For the second text box, I’m having a different kind of problem. This time, a ‘/’ character is being appended to the end of the string. This ‘/’ character does not appear when I have the JSP display it outside of a textbox. In this case, the string is only one word such as “XPath”, and the textbox is displaying “XPath/”

What is causing these text boxes to display oddly?

Answer 1

In both cases, the cause is likely the same – you’re missing quotes from the value attribute:

value=<%= msg.getName() %>

value=<%=msg.getSearchMethod() %>

Change to

value="<%= msg.getName() %>"

value="<%=msg.getSearchMethod() %>"

Without those quotes, you’re generating bad HTML, and relying on gracious behaviour from the browser.

Also, to be safe make sure that the Strings returned from those methods are properly HTML-ecapaped.