java - Where should I escape HTML strings, JSP page or Servlets? -

this question has answer here:

• xss prevention in jsp/servlet web application 8 answers

i appreciate providing me set of clear guidelines or ruling handling escaping strings. use escaping strings apache commons-lang-x.x.jar library. stringescapeutils.escapehtml(string toescape) method.

i need know:

(1) better escape strings, on jsp page or in servlet?

(2) recommend stringescapeutils.escapehtml(..) or <c:out> jstl

(3) handling multiline strings, better, use <br> directly in string, or \n , nl2br() method:

string strerror = "invalid username.\nplease try again.";

or

string strerror = "invalid username.<br>please try again.";

(4) how go escaping strings receive wild cards, example:

string strerror = "invalid user [%s].<br>please specify user."

(5) since javascript escape characters different. should use escape java strings rendered inside javascript sections of jsp page (eg. var name = "<%=javastringholdingname%>").

you need escape there can harm. in particular case, it's in view. user-controlled html can harm when inlined among html in view. source xss.

in well-designed jsp page (read: no scriptlets), jstl offers <c:out> tag , fn:escapexml() function escape html/xml.

<c:out value="${param.foo}" /> <input type="text" name="foo" value="${fn:escapexml(param.foo)}" />