How to Properly Escape Triply Nested Quotes in JSP

Question

We just upgraded Tomcat and the newer Tomcat doesn't like nested quotes in the tag, so we have to alternate between single and double quotes. For example,

We used to have,

<form id="search" action="<fmt:message key="search.url"/>">

Now we can change it to,

<form id="search" action="<fmt:message key='search.url'/>">

What should I do if the quotes are triply nested like this,

<form id="search" action="<fmt:message key='<c:out value="${requestScope.search_url}"/>'/>">

The above tag doesn't compile.

Answer 1

I've not tried this, but elsewhere in Java you can just escape the nested quotes, then escape the \ for the double-nested quotes:

<form id="search" action="<fmt:message key=\"<c:out
    value=\\\"${requestScope.search_url}\\\"/>\"/>">

Edit: As it is an attribute, the above probably won't work, but a similar approach might work with single-quotes:

<form id="search" action="<fmt:message key='<c:out
    value=\'${requestScope.search_url}\'/>'/>">

Alternatively, use a method call and have it return the formatted String...

Answer 2

If you don't want do update all your jsp:s just for the tomcat upgrade, set the system property "org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING" to false.

Easiest way to this is by editing catalina.sh and adding the following to JAVA_OPTS:

-Dorg.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING=false

Answer 3

You've probably long since solved this problem, but in case anyone else runs across this:

That doesn't compile not because of the nested quotes, but because of the nested tags. You can't use a c:out inside the attribute of the fmt:message tag. However, you can get it to work by setting a temporary variable:

<c:set var="foo"><c:out value="${requestScope.search_url}"/></c:set>
<form id="search" action="<fmt:message key='${foo}'/>">

Also, calling your example "triply" nested quotes is misleading. The double quote characters surrounding the value of the action attribute of your form tag do NOT behave like quotes from the point of view of the jsp engine. Anything outside of a ${...} EL expression, or outside of a known jsp tag with a known prefix is treated as arbitrary bytes.

Answer 4

Several ways:

1. c:out is not necessary:

    <form id="search" action="<fmt:message key='${requestScope.search_url}'/>">
   

2. fmt:message has a var attribute which stores the result in page context:

    <fmt:message key="${requestScope.search_url}" var="search_url" />
    <form id="search" action="${search_url}">
   

3. For the case c:out is mandatory (XML escaping and so on, I however question the value of XML escaping for message keys), it has a var attribute as well:

    <c:out value"${requestScope.search_url}" var="search_url" />
    <fmt:message key="${search_url}" var="search_url" />
    <form id="search" action="${search_url}">