Search code examples
jspstruts2escapingstruts-tagshtml-escape

Does the Struts2 <s:set> tag escape HTML by default?


Unless escapeHtml="false" is explicitly set, the <s:property> tag escapes HTML by default:

<s:property value="someValue" />
<!-- the HTML contained in "someValue" will be escaped. -->

Does <s:set> also behave this way ?

<s:set var="myVariable" value="someValue" />
<!-- will the HTML contained in "someValue" be escaped ? -->

Solution

  • No, <s:set> tag doesn't escape anything on its own.

    But you can exploit the <s:property /> escaping capabilities by using it in the <s:set/> body.

    Not escaped:

    <s:set var="myVariable" value="someValue" />
    

    Escaped:

    <s:set var="myVariable">
        <!-- the following value will be escaped -->
        <s:property value="someValue" />
    </s:set>