title: Where should I escape HTML strings, JSP page or Servlets?
body: <p>I would appreciate providing me with a set of clear guidelines or ruling for handling  escaping strings. What I use for escaping strings is the apache commons-lang-x.x.jar library. Specifically the <code>StringEscapeUtils.escapeHtml(String toEscape)</code> method.</p>
  
  <p>I need to know:</p>
  
  <p>(1) Where is it better to escape strings, on the JSP page or in the Servlet?</p>
  
  <p>(2) What do you recommend StringEscapeUtils.escapeHtml(..) or &lt;c:out&gt; from JSTL</p>
  
  <p>(3) Handling multiline strings, which is better, use &lt;br&gt; directly in the string, or \n and a nl2br() method:</p>
  
  <p><code>String strError = "Invalid username.\nPlease try again.";</code></p>
  
  <p>or</p>
  
  <p><code>String strError = "Invalid username.&lt;br&gt;Please try again.";</code></p>
  
  <p>(4) How would I go escaping strings that receive wild cards, example:</p>
  
  <p><code>String strError = "Invalid user [%s].&lt;br&gt;Please specify another user."</code></p>
  
  <p>(5) Since javascript escape characters are different. What should I use to escape Java strings that are to be rendered inside the javascript sections of the JSP page (eg. <code>var name = "&lt;%=javaStringHoldingName%&gt;"</code>).</p>