JSTL可以預防XSS Injection (escapeXml)

http://docs.oracle.com/javaee/1.4/tutorial/doc/JSTL4.html


escapeXml預設是true

.