0

I have a jsp page which has drop down list, so that user can select one of the value from the drop down list.

I am using DynaValidatorActionForm. Some values contain single quote like (Java's). when i receive the value from server side the single quote is not populated in the form, instead it returning (Javas). Can some one help me in identifying the issue with this? What all things i have to handle for this scenario?

<form-bean name="studentForm" type="org.apache.struts.validator.DynaValidatorActionForm">
   <form-property name="name" type="java.lang.String" />
   <form-property name="language" type="java.lang.String" />
</form-bean>
<action path="/hello" name="studentForm" type="com.msn.java.StudentAction" scope="session" validate="false"
            parameter="_" >
            <forward name="success" path="/jsps/hello.jsp" />
            <forward name="failure" path="/jsps/failure.jsp" />
</action>

Java class

public ActionForward hello(ActionMapping mapping, ActionForm form, HttpServletRequest request, HttpServletResponse response)  throws Exception
    {    
String language=(String)((DynaActionForm) form).get("language");    
}
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
Naidu
  • 95
  • 1
  • 10
  • How are you displaying the values? If you're using JavaScript along with data from the server you may need to make sure you JS-escape the server data. – Dave Newton May 13 '14 at 16:33

1 Answers1

0

Special character(, < > '')are not displayed literally like that but instead they are interpreted as opening and closing tag by browser.

There are 5 special characters in html which needs to be escaped:

>  - &lt;
<  - &gt;
&  - &amp;
'  - &#039;
'' - &#034;

Similarly, you need to escape your special character '
This Link provides a good explanation on how to do that

Susie
  • 5,038
  • 10
  • 53
  • 74
  • They only need to be escaped if they appear in a context where they actually need to be escaped, e.g., if your JSP template is emitting JS and you embed server data with a quote, you *may* need to escape it. Conversely if you're just dumping a quoted string into HTML, no quote escaping is required. – Dave Newton May 13 '14 at 16:34