Package org.apache.velocity.tools.generic

Class EscapeTool

  • public class EscapeTool
extends java.lang.Object
    Tool for working with escaping in Velocity templates. It provides methods to escape outputs for Java, JavaScript, HTML, HTTP, XML and SQL. Also provides methods to render VTL characters that otherwise needs escaping. 

     Example uses:
  $java                        -> He didn't say, "Stop!"
  $esc.java($java)             -> He didn't say, \"Stop!\"

  $javascript                  -> He didn't say, "Stop!"
  $esc.javascript($javascript) -> He didn\'t say, \"Stop!\"

  $html                        -> "bread" & "butter"
  $esc.html($html)             -> "bread" & "butter"

  $xml                         -> "bread" & "butter"
  $esc.xml($xml)               -> "bread" & "butter"

  $sql                         -> McHale's Navy
  $esc.sql($sql)               -> McHale''s Navy

  $url                         -> hello here & there
  $esc.url                     -> hello+here+%26+there

  $esc.dollar                  -> $
  $esc.d                       -> $

  $esc.hash                    -> #
  $esc.h                       -> #

  $esc.backslash               -> \
  $esc.b                       -> \

  $esc.quote                   -> "
  $esc.q                       -> "

  $esc.singleQuote             -> '
  $esc.s                       -> '

  $esc.exclamation             -> !
  $esc.e                       -> !

 Example toolbox.xml config (if you want to use this with VelocityView):
 <tool>
   <key>esc</key>
   <scope>application</scope>
   <class>org.apache.velocity.tools.generic.EscapeTool</class>
 </tool>

    This tool is entirely threadsafe, and has no instance members. It may be used in any scope (request, session, or application).

    Since:
    VelocityTools 1.2
    Version:
    $Id: $
    Author:
    Shinobu Kawai
    See Also:
    StringEscapeUtils

    • Constructor Summary

      Constructors 
      Constructor Description
      EscapeTool()
      Default constructor.

    • Method Summary

      All Methods Instance Methods Concrete Methods 
      Modifier and Type Method Description
      protected java.lang.String dumpString​(java.lang.String string, boolean key)
      This code was pulled from the Apache Harmony project.
      java.lang.String getB()
      Renders a backslash (\).
      java.lang.String getBackslash()
      Renders a backslash (\).
      java.lang.String getD()
      Renders a dollar sign ($).
      java.lang.String getDollar()
      Renders a dollar sign ($).
      java.lang.String getE()
      Renders an exclamation mark (!).
      java.lang.String getExclamation()
      Renders an exclamation mark (!).
      java.lang.String getH()
      Renders a hash (#).
      java.lang.String getHash()
      Renders a hash (#).
      java.lang.String getQ()
      Renders a double quotation mark (").
      java.lang.String getQuote()
      Renders a double quotation mark (").
      java.lang.String getS()
      Renders a single quotation mark (').
      java.lang.String getSingleQuote()
      Renders a single quotation mark (').
      java.lang.String html​(java.lang.Object string)
      Escapes the characters in a String using HTML entities.
      java.lang.String java​(java.lang.Object string)
      Escapes the characters in a String using Java String rules.
      java.lang.String javascript​(java.lang.Object string)
      Escapes the characters in a String using JavaScript String rules.
      java.lang.String propertyKey​(java.lang.Object string)
      Escapes the characters in a String using java.util.Properties rules for escaping property keys.
      java.lang.String propertyValue​(java.lang.Object string)
      Escapes the characters in a String using java.util.Properties rules for escaping property values.
      java.lang.String sql​(java.lang.Object string)
      Escapes the characters in a String to be suitable to pass to an SQL query.
      java.lang.String url​(java.lang.Object string)
      Escape the characters in a String to be suitable to use as an HTTP parameter value.
      java.lang.String xml​(java.lang.Object string)
      Escapes the characters in a String using XML entities.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • EscapeTool

        public EscapeTool()
        Default constructor.

    • Method Detail

      • java

        public java.lang.String java​(java.lang.Object string)
        Escapes the characters in a String using Java String rules.
        Delegates the process to StringEscapeUtils.escapeJava(String).
        Parameters:
        string - the string to escape values, may be null
        Returns:
        String with escaped values, null if null string input
        See Also:
        StringEscapeUtils.escapeJava(String)

      • propertyKey

        public java.lang.String propertyKey​(java.lang.Object string)
        Escapes the characters in a String using java.util.Properties rules for escaping property keys.
        Parameters:
        string - the string to escape values, may be null
        Returns:
        String with escaped values, null if null string input
        See Also:
        dumpString(String, boolean)

      • propertyValue

        public java.lang.String propertyValue​(java.lang.Object string)
        Escapes the characters in a String using java.util.Properties rules for escaping property values.
        Parameters:
        string - the string to escape values, may be null
        Returns:
        String with escaped values, null if null string input
        See Also:
        dumpString(String, boolean)

      • dumpString

        protected java.lang.String dumpString​(java.lang.String string,
                                      boolean key)
        This code was pulled from the Apache Harmony project. See https://svn.apache.org/repos/asf/harmony/enhanced/classlib/trunk/modules/luni/src/main/java/java/util/Properties.java

      • javascript

        public java.lang.String javascript​(java.lang.Object string)
        Escapes the characters in a String using JavaScript String rules.
        Delegates the process to StringEscapeUtils.escapeJavaScript(String).
        Parameters:
        string - the string to escape values, may be null
        Returns:
        String with escaped values, null if null string input
        See Also:
        StringEscapeUtils.escapeJavaScript(String)

      • html

        public java.lang.String html​(java.lang.Object string)
        Escapes the characters in a String using HTML entities.
        Delegates the process to StringEscapeUtils.escapeHtml(String).
        Parameters:
        string - the string to escape, may be null
        Returns:
        a new escaped String, null if null string input
        See Also:
        StringEscapeUtils.escapeHtml(String)

      • url

        public java.lang.String url​(java.lang.Object string)
        Escape the characters in a String to be suitable to use as an HTTP parameter value.
        Uses UTF-8 as default character encoding.
        Parameters:
        string - the string to escape, may be null
        Returns:
        a new escaped String, null if null string input See java.net.URLEncoder#encode(String,String).
        Since:
        VelocityTools 1.3

      • xml

        public java.lang.String xml​(java.lang.Object string)
        Escapes the characters in a String using XML entities.
        Delegates the process to StringEscapeUtils.escapeXml(String).
        Parameters:
        string - the string to escape, may be null
        Returns:
        a new escaped String, null if null string input
        See Also:
        StringEscapeUtils.escapeXml(String)

      • sql

        public java.lang.String sql​(java.lang.Object string)
        Escapes the characters in a String to be suitable to pass to an SQL query.
        Delegates the process to StringEscapeUtils.escapeSql(String).
        Parameters:
        string - the string to escape, may be null
        Returns:
        a new String, escaped for SQL, null if null string input
        See Also:
        StringEscapeUtils.escapeSql(String)

      • getDollar

        public java.lang.String getDollar()
        Renders a dollar sign ($).
        Returns:
        a dollar sign ($).
        See Also:
        getD()

      • getD

        public java.lang.String getD()
        Renders a dollar sign ($).
        Returns:
        a dollar sign ($).
        See Also:
        getDollar()

      • getHash

        public java.lang.String getHash()
        Renders a hash (#).
        Returns:
        a hash (#).
        See Also:
        getH()

      • getH

        public java.lang.String getH()
        Renders a hash (#).
        Returns:
        a hash (#).
        See Also:
        getHash()

      • getBackslash

        public java.lang.String getBackslash()
        Renders a backslash (\).
        Returns:
        a backslash (\).
        See Also:
        getB()

      • getB

        public java.lang.String getB()
        Renders a backslash (\).
        Returns:
        a backslash (\).
        See Also:
        getBackslash()

      • getQuote

        public java.lang.String getQuote()
        Renders a double quotation mark (").
        Returns:
        a double quotation mark (").
        See Also:
        getQ()

      • getQ

        public java.lang.String getQ()
        Renders a double quotation mark (").
        Returns:
        a double quotation mark (").
        See Also:
        getQuote()

      • getSingleQuote

        public java.lang.String getSingleQuote()
        Renders a single quotation mark (').
        Returns:
        a single quotation mark (').
        See Also:
        getS()

      • getS

        public java.lang.String getS()
        Renders a single quotation mark (').
        Returns:
        a single quotation mark (').
        See Also:
        getSingleQuote()

      • getExclamation

        public java.lang.String getExclamation()
        Renders an exclamation mark (!).
        Returns:
        an exclamation mark (!).
        See Also:
        getE()

      • getE

        public java.lang.String getE()
        Renders an exclamation mark (!).
        Returns:
        an exclamation mark (!).
        See Also:
        getExclamation()