public final class EscapeChars
extends java.lang.Object
Modifier and Type | Method and Description |
---|---|
static java.lang.String |
forHrefAmpersand(java.lang.String aURL)
Escape all ampersand characters in a URL.
|
static java.lang.String |
forHTML(java.lang.String aText)
Escape characters for text appearing in HTML markup.
|
static java.lang.String |
forRegex(java.lang.String aRegexFragment)
Replace characters having special meaning in regular expressions
with their escaped equivalents, preceded by a '\' character.
|
static java.lang.String |
forReplacementString(java.lang.String aInput)
Escape '$' and '\' characters in replacement strings.
|
static java.lang.String |
forScriptTagsOnly(java.lang.String aText)
Disable all tags in aText.
|
static java.lang.String |
forURL(java.lang.String aURLFragment)
Synonym for URLEncoder.encode(String, "UTF-8").
|
static java.lang.String |
forXML(java.lang.String aText)
Escape characters for text appearing as XML data, between tags.
|
static java.lang.String |
toDisableTags(java.lang.String aText)
Return aText with all '<' and '>' characters
replaced by their escaped equivalents.
|
public static java.lang.String forHTML(java.lang.String aText)
This method exists as a defence against Cross Site Scripting (XSS) hacks. The idea is to neutralize control characters commonly used by scripts, such that they will not be executed by the browser. This is done by replacing the control characters with their escaped equivalents.
The following characters are replaced with corresponding HTML character entities :
Character | Replacement |
---|---|
< | < |
> | > |
& | & |
" | " |
\t | |
! | ! |
# | # |
$ | $ |
% | % |
' | ' |
( | ( |
) | ) |
* | * |
+ | + |
, | , |
- | - |
. | . |
/ | / |
: | : |
; | ; |
= | = |
? | ? |
@ | @ |
[ | [ |
\ | \ |
] | ] |
^ | ^ |
_ | _ |
` | ` |
{ | { |
| | | |
} | } |
~ | ~ |
Note that JSTL's <c:out>
escapes only the first
five of the above characters.
public static java.lang.String forHrefAmpersand(java.lang.String aURL)
Replaces all '&' characters with '&'.
An ampersand character may appear in the query string of a URL. The ampersand character is indeed valid in a URL. However, URLs usually appear as an HREF attribute, and such attributes have the additional constraint that ampersands must be escaped.
The JSTL
public static java.lang.String forURL(java.lang.String aURLFragment)
Used to ensure that HTTP query strings are in proper form, by escaping special characters such as spaces.
It is important to note that if a query string appears in an HREF attribute, then there are two issues - ensuring the query string is valid HTTP (it is URL-encoded), and ensuring it is valid HTML (ensuring the ampersand is escaped).
public static java.lang.String forXML(java.lang.String aText)
The following characters are replaced with corresponding character entities :
Character | Encoding |
---|---|
< | < |
> | > |
& | & |
" | " |
' | ' |
Note that JSTL's <c:out>
escapes the exact same set of
characters as this method. That is, <c:out>
is good for escaping to produce valid XML, but not for producing safe
HTML.
public static java.lang.String toDisableTags(java.lang.String aText)
public static java.lang.String forRegex(java.lang.String aRegexFragment)
The escaped characters include :
public static java.lang.String forReplacementString(java.lang.String aInput)
Synonym for Matcher.quoteReplacement(String).
The following methods use replacement strings which treat '$' and '\' as special characters:
If replacement text can contain arbitrary characters, then you will usually need to escape that text, to ensure special characters are interpreted literally.
public static java.lang.String forScriptTagsOnly(java.lang.String aText)
Insensitive to case.
Copyright (c) 2017 Software AG. All Rights Reserved.