In the world of web development, properly escaping user-generated content is one of the most critical security concerns. Cross-Site Scripting (XSS) attacks remain a top web security risk, where malicious scripts are injected into web pages viewed by other users. While developers have long struggled with manual string concatenation and remembering to escape output, modern Java template engines provide a robust solution for safe HTML generation by default.

The Problem: Why Manual HTML Construction is Dangerous

Consider a simple user comment feature. A naive implementation might look like this:

// UNSAFE - Never do this!
String userComment = "<script>stealCookies()</script>";
String userProfile = "Johnny'><img src=x onerror=alert(1)>";
String html = "<div class='comment'>" + 
"<p>User: " + userProfile + "</p>" +
"<p>" + userComment + "</p>" +
"</div>";

When rendered, this would execute the malicious JavaScript, potentially compromising user sessions or spreading malware. The fundamental issue is that we're treating user input as trusted HTML rather than plain text that needs proper escaping.

Template Engines: The Safe Alternative

Modern Java template engines solve this problem through context-aware auto-escaping. They understand the context where a value will be inserted (HTML content, attribute, JavaScript, etc.) and apply the appropriate escaping rules automatically.

1. Thymeleaf: Natural Templates

Thymeleaf is a popular choice that allows for natural templates that can be viewed statically in browsers.

// In your controller
model.addAttribute("userName", "John <script>alert('xss')</script>");
model.addAttribute("userBio", "I love Java & Spring!");
model.addAttribute("websiteUrl", "https://example.com\" onclick=\"alert(1)");
// In your template (HTML)
/*
<div th:inline="text">
<h2>Welcome, [[${userName}]]!</h2>
<p th:text="${userBio}">Default bio</p>
<a th:href="@{${websiteUrl}}" th:text="${userName}">Profile</a>
</div>
*/

Result: Thymeleaf automatically escapes:

• userName becomes John <script>alert('xss')</script>
• userBio becomes I love Java & Spring!
• websiteUrl is safely encoded in the href attribute

2. JSP with JSTL: The Enterprise Standard

While older, JSP with JSTL escape tags is still widely used:

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="fn" uri="http://java.sun.com/jsp/jstl/functions" %>
<div>
<h2>Welcome, <c:out value="${userName}" />!</h2>
<p><c:out value="${userBio}" /></p>
<a href="<c:out value='${websiteUrl}' />">View Profile</a>
</div>

The <c:out> tag automatically escapes HTML characters, turning <script> tags into harmless text.

3. JavaServer Faces (JSF): Component-Based Safety

JSF provides automatic escaping by default in its components:

<h:outputText value="#{userController.userName}" />
<h:inputText value="#{userController.userComment}" />
<h:link value="Profile" outcome="#{userController.profilePage}" />

JSF components automatically encode output, preventing XSS attacks without additional developer effort.

Context-Aware Escaping: Beyond Basic HTML

Advanced template engines understand different contexts require different escaping rules:

// Controller
model.addAttribute("jsonData", "{\"name\": \"</script><script>alert('xss')\"}");
model.addAttribute("cssValue", "background: url(javascript:alert('XSS'))");
model.addAttribute("urlParam", "page.html?param=<script>alert('xss')</script>");

<!-- Thymeleaf handles different contexts safely -->
<script th:inline="javascript">
var userData = /*[[${jsonData}]]*/ 'default';
// Correctly escapes for JavaScript context
</script>
<div th:style="'background:' + ${cssValue}">
<!-- CSS context escaping -->
</div>
<a th:href="@{/page(param=${urlParam})}">Link</a>
<!-- URL encoding applied -->

When You Need Raw HTML: Safe Unescaping

Sometimes you genuinely need to output HTML (like content from a trusted rich-text editor). Template engines provide safe ways to do this:

// Thymeleaf
<p th:utext="${trustedHtmlContent}">Default text</p>
// JSP with JSTL  
<p><c:out value="${trustedHtmlContent}" escapeXml="false" /></p>
// But always sanitize first!
import org.jsoup.Jsoup;
import org.jsoup.safety.Safelist;
String safeHtml = Jsoup.clean(untrustedHtml, Safelist.basic());

Best Practices for HTML Security

1. Choose template engines with auto-escaping enabled by default
2. Never concatenate strings to build HTML or SQL
3. Use context-specific escaping (HTML, CSS, JavaScript, URL)
4. Sanitize before storing, escape before rendering
5. Use Content Security Policy (CSP) headers as an additional layer
6. Keep your template engines updated

Conclusion

Modern Java template engines have made XSS prevention significantly easier by baking security into their core design. By leveraging Thymeleaf, JSF, JSP with JSTL, or other modern alternatives, developers can focus on building features rather than manually escaping every piece of user input. The key is to work with the template engine's safety features rather than against them—embracing auto-escaping as the default and only disabling it deliberately when absolutely necessary, with proper sanitization in place.

Safe HTML generation is no longer a complex security challenge but a solved problem when you use the right tools correctly.