Struts XSS and SQL Injection vulnerabilities

Hi All,

Does anyone there knows how struts handle XSS and SQL Injection vulnerabilities.
I mean what are the classes which handle these vulnerabilities.

It's a design change not a class you just call.

SQL Injection - make sure you are always using prepared statements and passing in all user values via parameters

XSS - make sure you are escaping user content on submission or on rendering. Struts does provide some protection in their tags. I recall seeing it extended, so I don't know how complete it is.

Is tags the only way to avoid XSS ?

I have implimented a filter using that I have escaped the user content from the request and I have also used prepared and callable stmts to avoid SQL Injection.

But filters reduces the performance and so just wanted to know how it has been implemented in struts releases where they have taken care of such vulnerabilities. So that I could use a performance based code.

It's not the filter reducing the performance; it's the search/replace. Any solution is going to need to do that. Luckily, it reduces the performance by such a tiny percentage compared to the database call that it's a non-issue.