What is c: out used for jsp

Question

I saw something like

<c:out   something

</c:out>

what is it used for

Answer 1

Used to print server-side variables to prevent HTML / XML leakage. When you apply this on a user-controlled input (request parameters, headers, cookies, stored data, etc.), this will prevent your XSS website from attacking holes.

If the displayed data is not controlled by the end user and you are using JSP 2.0 or later ( web.xmldeclared as Servlet 2.4 or later, and the container supports it), you can also just use

${bean.property}

instead

<c:out value="${bean.property}" />

See also:

• XSS Prevention in Java / JSP
• How does an XSS attack really work?

Answer 2

. , , . c:out html-, XSS.

, " " , null:

<c:out value="${foo.bar}">Foobar is null!</c:out>

Answer 3

c:out HTML-, .

, null.

.

<c:out value="${variable}">variable is null</c:out>

"variable is null", .