Avoid Cross site scripting in Jsp

[jami siva]

How to avoid Cross site scripting in Jsp.
Currently I am using scriptlet code to display any error messages.
Below is the code :
<%
out.println (error.getMessage() );
%>

How do make this statement to avoid Cross Site Scripting.

Thank you guys
Siva

[Ulf Dittmer]

In which way do you think this code is vulnerable to XSS attacks? Is the string returned by getMessage generated from user input?

[jami siva]

No, this getMessage is generated from server.
Even i don't know that is the only code to attack Cross site scripting, If so, How to write code in jsp to avoid things means Cross site scripting.

[Ulf Dittmer]

Start reading here: http://www.coderanch.com/how-to/java/SecurityFaq#web-apps

[Jeanne Boyarsky]

If you use cut instead of a scriptlet, it will escape the special characters for you.