Escaping User Input

Tutorials
/
Server Tutorials
/
Sanitizing User Input
/
Escaping User Input

Escaping User Input

This example uses an the Apache Commons Text library to escape user input. Learn more in the java server libraries tutorial.

index.html contains an HTML form:

<!DOCTYPE html>
<html>
  <head>
    <title>Form</title>
  </head>
  <body>
    <h1>Enter some input:</h1>
    <form action="/user-input-escaped/form" method="POST">
      <input type="text" name="data" value="<h1>oh no</h1>">
      <br><br>
      <input type="submit" value="Submit">
    </form>
  </body>
</html>

FormServlet.java handles the POST request by escaping the user’s content and outputting it in the response:

package io.happycoding.servlets;

import java.io.IOException;
import jakarta.servlet.annotation.WebServlet;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.apache.commons.text.StringEscapeUtils;

@WebServlet("/form")
public class FormServlet extends HttpServlet {

  @Override
  public void doPost(HttpServletRequest request, HttpServletResponse response)
      throws IOException {

    String userInput = request.getParameter("data");
    String escapedUserInput = StringEscapeUtils.escapeHtml4(userInput);

    response.setContentType("text/html");
    response.getWriter().println("You entered: " + escapedUserInput);
  }
}

input form

Because the servlet escapes the data, the HTML is rendered as text in the output:

html output

See the server libraries tutorial and the sanitizing user input tutorial for more information.

Sanitizing User Input Examples

Unsanitized User Input Unsanitized User Input

See what happens when you don't sanitize user input.

Escaping User Input Escaping User Input

Use Apache Commons Text to escape user input.

Add Your Own Example Add Your Own Example

Add your own example to Happy Coding.

Comments

Happy Coding is a community of folks just like you learning about coding.
Do you have a comment or question? Post it here!

Comments are powered by the Happy Coding forum. This page has a corresponding forum post, and replies to that post show up as comments here. Click the button above to go to the forum to post a comment!