jsp - XSS prevention using fn:escapeXml() leaves the user input escaped -
i using fn:escapexml(bean.field)
in jsp input tags' value attributes. see if user types special characters , hits on save button, input gets escaped , shown in text box. instance if type "mr & mrs" , hit on save, shown in screen "mr & mrs". user community says ambiguous. must see "mr & mrs". going wrong here. how fix this.
thanks uma
Comments
Post a Comment