title: Escape HTML entities in JSP / JSPX: no solution for problem that should not even exist?
body: <p>We use jspx as template engine. We have dozen of screens with hundreds of el expressions like ${user.firstName} or "${mail.subject}"</p>
  
  <p>And all this HTML code is not escaped by default. If there would be something with &lt; or " in field -- screen will fail. We can always use fn:escapeXml but doing so in all places really boring. </p>
  
  <p>1)
  Does there is a way to do escape by default?</p>
  
  <p>The only way I know is to hack JSP compiler (like jasper for tomcat). But it is not a way to go.</p>
  
  <p>2)
  Why somebody may ever need unescaped HTML in el? Storing HTML outside of template (in database for example) is not a good practice. </p>
  
  <p>3) I am sure template engine should handle it automatically (as it done in XSLT), why should user care about it?
  Manual escaping (fn:escapeXml) smells like SQL manual escaping (which is used instead of JDBC setParam): boilerplate code and good place for sql-injection (cross-site scripting in our case).</p>