We Keep Coding

ESAPI not working in JSP

I have imported the ESAPI libraries and try to use the following code in jsp -
<s:set var="varUrl" value="%{'<>'}" />
<s:property value="varUrl" />
<esapi:encodeForHTML><s:property value="varUrl"/></esapi:encodeForHTML>
The above code is working fine and I can see the encoded special chars in the browser.
Now when I try this code -
<input type="hidden" name="test" value="<%=ESAPI.encoder().encodeForHTML("<>")%>"/>
Here in this above line the output is not encoded. It shows plain <>.
Does anyone know the reason? Am I not using this the right way? Please suggest.
I am following this link - Using ESAPI in JSP

The encoding is working as expected. Actually I did a mistake of using the IE debugger to check the encoded values. The IE debugger showed inconsistent encoded values. The best way to check if the symbols are encoded or not is to view the page source. And that is what I did now. The values are encoded as expected.

freemarker display ${..} as html rather than string

I get html code from server to build freemarker.ftl.
Example:
Server return:
String htmlCode="<h1>Hello</h1>";
freemarker.ftl
${htmlCode}
except:Hello
actually: <h1>Hello</h1>
what can i do?

By default FreeMarker has no auto-escaping on, so it should print that value as HTML. But as it doesn't as you say, I can imagine two possibilities:
You are inside <#escape x as x?html>...</#escape>, or that was added to the template by a custom TemplateLoader. In that case, in 2.3.x you have to write <#noescape>${htmlCode}</#noescape>. (In 2.4 it will be much less verbose if everything goes as planned.)
That value was escaped before it reaches FreeMarker. So the template already gets <h1>Hello</h1> as the string.

Bad encoding only on a half of page

Hello I want to ask what can be the source of problem with bad encoding on the page.
This problem is very specific, because first part of page has good encoding and second part is broken.
Moreover it appears only in some scenarios, not allways.
The most weird thing is that starts to appear in the middle of one message and after this message, the rest of page has badly encoded characters.
This message is included in JSP with this part of code <fmt:message key="the.text.wchich.makes.problems"/>
Problem is not related to JSP, because bad encoding appears in the middle of message.
Gratulujeme, toto číslo si môžete zarezervovať kliknutím na tlačidlo Pokračovať.
But sometimes it outputs as
Gratulujeme, toto číslo si môžete zarezervovať kliknut�­m na tlaÄidlo PokraÄovaÅ¥.
or
Gratulujeme, toto číslo si mô�¾ete zarezervovaÅ¥ kliknutím na tlaÄidlo PokraÄovaÅ¥.
So it is probably not the fault of badly entered text in database.
We are using Liferay 6.0, jsp, spring. Localized strings are stored in Oracle 11g database.
So, how is it possible that encoding begin to break in the middle of page?

You might need to specify encoding in your JSPs as:
<%# page contentType="text/html; charset=UTF-8" %>
You should be able to achieve the same result via CharacterEncodingFilter with forceEncoding parameter set and mapped to * path + INCLUDE dispatch.

This is just one suggestion. Try to set locale from themeDisplay object.
<fmt:setLocale value="<%=themeDisplay.getLocale() >"/>
see if it helps to fmt:message to identify proper locale of message.
Note: This expects that you should have proper locale set for user or at portal level.

Part after # is missing from the request parameter value

I did a hello world web application in Java on Tomcat container. I have a query string
code=askdfjlskdfslsjdflksfjl#_=_
with underscores on both sides of = in the URL. When I tried to retrieve the query string in the servlet by request.getParameter("code"), I get only askdfjlskdfslsjdflksfjl. The part after # is missing.
How is this caused and how can I solve it?

That's because the part of the url after # is not a part of the query.
Section 3.4 of approprate RFC says:
The query component is indicated by the first question
mark ("?") character and terminated by a number sign ("#") character
or by the end of the URI.

The # is only interpreted by the browser, not the server. If you want to pass the # character to the server, you must URLEncode it.
Example:
URLEncoder.encode("code=askdfjlskdfslsjdflksfjl#=", "UTF-8");

Please read the percent encoding on Wikipedia. The # and = are reserved characters in URLs. Only unreserved characters can be used plain in URLs, all other characters are supposed to be URL-encoded. The URL-encoded value of a # is %23 and = is %3D. So this should do:
code=askdfjlskdfslsjdflksfjl%23_%3D_
If this actually originates from a HTML <a> link in some JSP like so:
some link
then you should actually have changed it to use JSTL's <c:url>:
<c:url var="servletUrlWithParam" value="servletUrl">
<c:param name="code" value="askdfjlskdfslsjdflksfjl#_=_" />
</c:url>
some link
so that it get generated as
some link
Note that this is not related to Java/Servlets per-se, this applies to every web application.

Special Characters In Webapp being saved differently

I'm creating a webapp using Spring MVC and some of the information I'm pulling is from a Database, so it was edited elsewhere. When I import some have, what I consider, special characters, such as
“_blank”
as opposed to using the standard keyboard
"_blank".
When I display this on my website textarea, it displays fine, but when I attempt to save it back into the string when submitting the form in the spring textArea, the string now has ? where the 'special' characters were. They were obviously imported into a String fine, but somewhere in the save process it's not allowing it as a special character. Any idea what is causing this or why?

Sounds like a character encoding problem. Try setting the character set of the page containing the form to UTF-8.
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />