Escaping HTML in a Custom Tag

Question

Hello, all. I am sadly failing to find a library function to escape HTML in Java. I'm writing a tag that used to use JSTL as a custom tag and don't know exactly where to find the functionality the JSTL is using. Consider the old JSP:
<c:forEach items="${versions}" var="version">
     <tr>
         <td><c:out value="${version.version}"/></td>
         <td><c:out value="${version.releaseDate}"/></td>
    </tr>
</c:forEach>and the new custom tag class:
public class VersionTableTag implements Tag
    private PageContext context;
    private Tag parent;
    public int doEndTag() throws JspException
        return EVAL_PAGE;
    public int doStartTag() throws JspException
        JspWriter out = context.getOut();
        List versions;
        try
            versions = (List)(context.getVariableResolver().resolveVariable("versions"));
        } catch (ELException e)
            versions = new ArrayList();
        try
            out.println("<table>");
            out.println("<tr>");
            out.println("<th>Version</th>");
            out.println("<th>Release Date</th>");
            out.println("</tr>");
            for (Object o : versions)
                VersionVO version = (VersionVO)o;
                out.println("<tr>");
                out.println("<td>");
                out.println(version.getVersion()); // NOTE: not properly escaped
                out.println("</td><td>");
                out.println(version.getReleaseDate().toString()); // NOTE: not properly escaped
                out.println("</td>");
                out.println("</tr>");
            out.println("</table>");
        } catch (IOException e)
            throw new JspException(e);
        return SKIP_BODY;
}My questions are as follows:
*1.* Is it possible to define a tag using a JSP document rather than a Java class? All I'm really after is something similar to an include but I want to be able to provide attributes to it in the long run.
*2.* Is there some library function I can use to escape the HTML in the VO above?

Answer 1

1. Is it possible to define a tag using a JSP document rather than a Java class? All I'm really after is something similar to an include but I want to be able to provide attributes to it in the long run.Yes. It was introduced with JSP2.0: tag files.
Just like a JSP lets you write a servlet easily, a tag file lets your write a Custom tag class easily.
http://java.sun.com/javaee/5/docs/tutorial/doc/bnama.html
2. Is there some library function I can use to escape the HTML in the VO above?
There is one provided in the jakarta commons "lang" library.
http://commons.apache.org/lang/
They provide a class "StringEscapeUtils" which will do most of the common escaping that you require.
How hard is it to write something that replaces & < and > though?