Search code examples
javajsphtml-encodeesapi

ESAPI not working in JSP

I have imported the ESAPI libraries and try to use the following code in jsp - 

<s:set var="varUrl" value="%{'<>'}" />
<s:property value="varUrl" />
<esapi:encodeForHTML><s:property value="varUrl"/></esapi:encodeForHTML>

The above code is working fine and I can see the encoded special chars in the browser.

Now when I try this code - 

<input type="hidden" name="test" value="<%=ESAPI.encoder().encodeForHTML("<>")%>"/>

Here in this above line the output is not encoded. It shows plain <>.

Does anyone know the reason? Am I not using this the right way? Please suggest. I am following this link - Using ESAPI in JSP

Solution

  • The encoding is working as expected. Actually I did a mistake of using the IE debugger to check the encoded values. The IE debugger showed inconsistent encoded values. The best way to check if the symbols are encoded or not is to view the page source. And that is what I did now. The values are encoded as expected.