Home/ Questions/Q 8552953
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-11T14:32:21+00:00

when a form is submited that inserts a record into the database and the

  • 0

when a form is submited that inserts a record into the database and the operation was successful, I do a redirect and then pass some parameters in the Url to display the newly inserted record along with a header message (i.e., “Insert was successful”).

response.sendRedirect(yPage + "?pid=" + ipd + "&feedback=" + form.getFormFeebackSB() );

I would then display in jsp like:
<c:out value="${param.feedback}" />

I use a redirect instead of a forward because I want the operation to be idempotent. When I used forward users who hit refresh after a successful insert most often always clicked retry on the warning popup and it resulted in duplicate inserts.

Our IT department then discovered that I had a XSS vulnerability:

page.jsp?feedback=%3Cscript%20type=%22text/javascript%22%3Ealert%28%27xss%27%29;%3C/script%3E

So I changed to this:
<c:out value="${param.feedback}" escapeXml='true'/>

but now any <br> in my FeedbackSB get escaped and I end up with a header message as such

Insert was successful<br>An email was sent to Joe<br>Now Complete the XYZ Form;

what is the standard way to pass messages back to user, while keeping any submits idempotent and protecting against XSS?

EDIT:

I searched Flash Scope and came across this http://blog.smartkey.co.uk/2011/01/implementing-flash-scope-in-java-web-applications/
Since my application would require a lot of work to incorporate a framework, the filter mentioned in that link was easy to incorporate and was able to implement flash scope with very little effort.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    Don’t pass the message itself in a redirect. Store the message under a unique key in the session, redirect with the key of this message as URL parameter, then go to the session, get the message, and display it.

    I would also remove the message from the session immediately: if the user refreshes, there is no reason to tell him again that the insert was successful.

    Most of the MVC frameworks do that for you, using what they usually call a Flash scope (session attributes that are removed from the session as soon as they’ve been retrieved).

    • 0