What is the difference between escapeXml and escapeHtml?

Question

I would like to escape characters in JSP pages. Which is more suitable, escapeXml or escapeHtml?

Answer 1

There's no such thing as escapeHtml in JSP. You normally use (it by the way already defaults to true, so you can omit it) or fn:escapeXml() to escape HTML in JSP.

E.g.

It will escape them as XML entities which works perfectly fine in plain HTML as well. They are only literally called XML entities because HTML entities are invalid in XML.

See also:

• Java 5 HTML escaping To Prevent XSS
• Escaping html in Java