When using Ajax for a message, a problem has arisen. Because after the message content is written, the content is submitted through Ajax, and the content of the message is added to the page with JS. When browsing the message, it is also done through AJAX requests and then displayed. So, if someone writes a JS statement in a message, The statement is executed. The solution is to escape and display these special characters. If you use the JSTL tag in your JSP, it's easy. Use the <c:out value= "${r.content}"/> This way, it will automatically escape, The parameter Escapexml= "true" is omitted, which is the default. Therefore, do not use El expressions when displaying the content submitted by these users, as El is not automatically escaped, and is better done with c:out. And if it's the AJAX request and then the display, Then use the following method. It's actually very simple.
Start building with 50+ products and up to 12 months usage for Elastic Compute Service
1 on 1 presale consultation
24/7 Technical Support 6 Free Tickets per Quarter Faster Response
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.
A comprehensive suite of global cloud computing services to power your business
Payment Methods We Support
