Search code examples
jspjstl

value="${fn:escapeXml(true)}"/> Is it useful?

Have a quick question:

value="${fn:escapeXml(true)}"/>

This code above, I am using it within a hidden input field as below in various forms:

<input type="hidden" name="Eatit" value="${fn:escapeXml(false)}"/>

I know this JSTL function is useful in preventing XML injection within forms for strings.

My question is can a boolean or an integer be manipulated in the same way and is this a useful solution against hidden input value tampering?

Thanks.

Solution

  • No, this is useless. Escaping the value is useful when it's an string which contains or could contain special characters needing to be escaped. The literal Strings "true" and "false" don't contain any such character, so escaping them is unnecessary.