Unless escapeHtml="false"
is explicitly set, the <s:property>
tag escapes HTML by default:
<s:property value="someValue" />
<!-- the HTML contained in "someValue" will be escaped. -->
Does <s:set>
also behave this way ?
<s:set var="myVariable" value="someValue" />
<!-- will the HTML contained in "someValue" be escaped ? -->
No, <s:set>
tag doesn't escape anything on its own.
But you can exploit the <s:property />
escaping capabilities by using it in the <s:set/>
body.
Not escaped:
<s:set var="myVariable" value="someValue" />
Escaped:
<s:set var="myVariable">
<!-- the following value will be escaped -->
<s:property value="someValue" />
</s:set>