JSTL c:set tag replace single qoutes to & #039;

Question

Hi all,
i'm using the JSTL-Tags to create and query a SQL-Statement.
I use the c:set Tag to set a part of my query...
<c:set var="selectSeveral" value="d.hardwarecode = '${param.p_macAddress}'"/>
...and the sql:query Tag to excecute the query:
SELECT <c:out value="${selectValue}"/>
FROM event e, device d, billingunit b
WHERE e.eventdate >= to_date('<c:out value="${param.p_dateFrom}"/>', 'DD.MM.YYYY HH24:MI:SS')
AND e.eventdate <= to_date('<c:out value="${param.p_dateTo}"/>', 'DD.MM.YYYY HH24:MI:SS')
AND <c:out value="${selectSeveral}"/>
AND e.deviceid = d.deviceid
AND d.billingunitid = b.billingunitid
GROUP BY <c:out value="${groupValue}"/>
By excecuting the Statement with Tomcat i get a Oracle ORA-00911: invalid character Errormessage.
I found the reason for this in the Logfile, where the Statement looks like this:
SELECT e.eventdate, e.sessionend, e.sourceip, e.amount, d.hardwarecode, d.typecode, b.name, b.code
FROM event e, device d, billingunit b
WHERE e.eventdate >= to_date('17.03.2003 19:44:06', 'DD.MM.YYYY HH24:MI:SS')
AND e.eventdate <= to_date('17.03.2003 20:54:59', 'DD.MM.YYYY HH24:MI:SS')
AND e.sourceip = & #039;172.24.214.222& #039;
AND e.deviceid = d.deviceid
AND d.billingunitid = b.billingunitid
ORDER BY eventdate asc
As you can see JSTL replaced the single quotes with the number code of the single quotes. (& #039;)
Any ideas how to solve this problem.
Thanks in advance.
Cu Daniel

Answer 1

Try setting the escapeXml attribute to false - it defaults to true, and will replace XML (and HTML) special characters to their entity codes. For example:
<c:out value="${selectValue}" escapeXml="false"/>