jsp如何避免xss攻击

Question

谁知道，求大神帮下忙.先谢谢了

Answer 1

你的意思是说在界面上想是Html代码，这个是完全可以处理的，只需要将那些"<",">"等符号转义就不会被执行，可以使用struts标签库输出，也可是替换这些特殊符号
实例：
String OutStr = "alert(&#39;XSS&#39;)";

OutStr = OutStr.replaceAll("&","&");

OutStr = OutStr.replaceAll("<","<");

OutStr = OutStr.replaceAll(">",">");

OutStr = OutStr.replaceAll("\"",""");

OutStr = OutStr.replaceAll("\'","'");

OutStr = OutStr.replaceAll("\(","(");

OutStr = OutStr.replaceAll("\)",")");

OutStr = OutStr.replaceAll("%","%");

OutStr = OutStr.replaceAll("\+","+");

OutStr = OutStr.replaceAll("-","-");

out.println(OutStr);