How to format a string inside within a "<c:out value='${" line

[Jason Smit]

I have the following:

<td align="center">
	<p>
		<c:out value='${numbers.IDNumber}' escapeXml='false'/>
	</p>
</td>

The number is displayed as:
12345678901234567890

I want to group the numbers in pairs of 4 as per below:
1234 5678 9012 3456 7890

[Bear Bibeault]

In order of likelihood, I'd write: a custom EL function to perform the formatting, or a custom tag to perform the formatting, or pre-format the string in the controller.

[Stefan Evans]

Just wondering, if this is expected to be a number, why the escapeXml Attribute is specified as false?

I would think yo uwould only want to set escapeXml to false in the specific cases where you are expecting to write HTML onto the page.

Otherwise you have a potential security hole.

[Bear Bibeault]

Good point, Stefan. If the source of the string is untrusted, the output should always be escaped. Otherwise, there's really no point to even using <c:out> at all; just use the EL expression.

[Jason Smit]

Hi,
Can you guys not put something together for me to test and try to implement?

[Bear Bibeault]

That's not how things work here. Try putting something together, post the code and whatever issues you are having with it.

Path of least resistance is pre-formatting the string in the controller. (But as I said, I'd personally go for the EL function.)