Alex Rivera | Logout

In JSTL/JSP when do I have to use <c:out value="${myVar}"/> and when can I just say ${myVar}

Asked 2011-07-04T18:09:01.130
16

I've been doing this the whole time in my JSP code:

<c:out value="${myVar}"/>

Today I just realized for the first time that I seem to be able to use this shorter version just as well:

${myVar}

It works without <c:out>!

Perhaps this is because my page is declared like this:

<%@ page language="java" contentType="text/html; 
charset=utf-8" pageEncoding="utf-8" isELIgnored="false" %>

So, my question is, can I replace <c:out> in my code with this shorter version? Is there any reason to keep using <c:out>? Or are there places where I might still need it?

java jsp jstl el
Edit
Report

1 Answer

8

Perhaps this is because my page is declared like this:

<%@ page language="java" contentType="text/html; 
charset=utf-8" pageEncoding="utf-8" isELIgnored="false" %>

Untrue. Just <%@page pageEncoding="UTF-8" %> was been sufficient. The remnant is all already the default.

EL in template text is supported since JSP 2.0 which goes hand in hand with Servlet 2.4 (which was already out since 2003... keep yourself up to date). So when you're running a Servlet 2.4 capable container (e.g. Tomcat 5.5 or newer) with a web.xml declared conform Servlet 2.4 API, then you'll be able to use EL in template text.

However, you should not use it to (re)display user-controlled input. So, do not use it to (re)display (saved) request headers, request cookies, request URLs, request parameters, request bodies, etc. This will put doors open to XSS attacks.

answered 2011-07-04T20:23:52.910

Your Answer