Better to use JSTL, something like:
<c:out value="${str}" escapeXml="false"/>
If str
comes in request, then
<c:out value="${param.str}" escapeXml="false"/>
Here, escapeXml="false"
will indicate that the html / xml tags should be evaluated and not escaped.
source share