This week's book giveaways are in the Java EE and JavaScript forums.
We're giving away four copies each of The Java EE 7 Tutorial Volume 1 or Volume 2(winners choice) and jQuery UI in Action and have the authors on-line!
See this thread and this one for details.
The moose likes JSP and the fly likes Text box with HTML tags security issue Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login


Win a copy of The Java EE 7 Tutorial Volume 1 or Volume 2 this week in the Java EE forum
or jQuery UI in Action in the JavaScript forum!
JavaRanch » Java Forums » Java » JSP
Bookmark "Text box with HTML tags security issue" Watch "Text box with HTML tags security issue" New topic
Author

Text box with HTML tags security issue

Avi Gafa
Greenhorn

Joined: Jul 24, 2008
Posts: 3
Hi All,
I have a text box(on a jsp page) which should enable a free txt input including an HTML tags.
Some background:
In my customer page, there is an empty <div> that shoud be filled dinamiclly by calling to my servlet.
my servlet should return a text that can be including an HTML tags and this text will be emmbeded in the div and will be formatted as a regular HTML.
in order to retrive this text, I'm giving my customer a text box where he can put his free text(again, including HTML tags) and I store it in the DB.
my problem is, how to give my customer the ability to put his free text with the HTML tags in the text box and in the DB and to avoid security issuse like SQL injection.

Thanks,
Avi
Bear Bibeault
Author and ninkuma
Marshal

Joined: Jan 10, 2002
Posts: 61082
    
  66

SQL injection problems can be handled in the model using techniques as outline in the JDBC forum (using PerparedStatements, for example). Script and HTML injection can be prevented by using the <c:out> JSTL tag when displaying the user-entered values, as <c:out> will properly HTML-encode any markup characters.


[Asking smart questions] [Bear's FrontMan] [About Bear] [Books by Bear]
 
With a little knowledge, a cast iron skillet is non-stick and lasts a lifetime.
 
subject: Text box with HTML tags security issue