tags:

views:

736

answers:

2

I remember working on a project with a group of developers and they always wanted static html text to be inside of an out tag (<c:out value="words" />). I don't remember why this was the case.

Is this really a best practice when building jsp pages? What are the advantages/disadvantages of such an approach?

+2  A: 

If you're just printing out plain text it's better to do it in html. The advantage of the c:out tag is that you can evaluate expressions inside the tag.

<c:out value="Hello ${user.firstName} ${user.lastName}"/>
Bill the Lizard
That advantage disappears in Servlet Spec 2.3+, when the container is able to provide EL support directly. As such, c:out should not be used just to output EL in a Servlet Spec 2.3+ container, when Hello ${user.firstName} ${user.lastName} is more readable without the c:out around it.
MetroidFan2002
Just be aware that EL does not escape special HTML characters. If the EL is outputting data supplied by a user theis leaves the application open to nasty security vulnerabilities such as cross-site scripting.
laz
+8  A: 

It is a terrible idea for static text. You then have no barrier as to what is static and what is dynamically generated.

Besides which, on Servlet Spec 2.3+ you can have dynamic text mixed with static text as:

This is static, not ${dynamic} text.

The only reasons to use c:out tags, in my experience:

  1. You're using an older servlet spec, and need them to output DYNAMIC text in some fashion

  2. You want to escape HTML output to avoid using <>, etc, replacing ampersands with their control codes, etc.

Otherwise, having them use static text confuses the programmer or maintainer...now where did I put that EL? It was in a c:out tag...but so was fifty other lines of static text!

MetroidFan2002
I think that escaping is the primary reason today to use c:out.
Peter Štibraný
As long as you're not using an older servlet spec (which some people are still forced to do, unfortunately, luckily I am not one of these poor souls), I agree with you - the escaping XML is lovely.
MetroidFan2002