For people without JSTL, they can use the Jakarta string taglib.
On Fri, 12 Dec 2003, Torgeir Veimo wrote:
> (sorry, lost quoting context..)
>
> > <display:column property="someUserEnteredData" escapeXML="true"/>
>
> > rather than
>
> > <display:column>
> > <c:out value="{row.someUserEnteredData}" escapeXML="true"/>
> > </display:column>
>
> Two comments from a user:
>
> JSTL is not allways available.
>
> The first one is the correct one in terms of usability and
> functionality. It's what many other taglibs who write out values do. And
> it's necessary to avoid cross site scripting vulnerabilities.
>
>
--
John York
Software Engineer
CareerSite Corporation
-------------------------------------------------------
This SF.net email is sponsored by: IBM Linux Tutorials.
Become an expert in LINUX or just sharpen your skills. Sign up for IBM's
Free Linux Tutorials. Learn everything from the bash shell to sys admin.
Click now! http://ads.osdn.com/?ad_id=1278&alloc_id=3371&op=click
_______________________________________________
displaytag-devel mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/displaytag-devel
