Secure Coding Practices for Java Web Applications - Secure Java: For Web Application Development - page 225

XML. his can be utilized for output encoding in Web applications. he escapes are coded as static
ields in this class. Some of the important ones are ESCAPE_CSV for CSV, ESCAPE_HTML3
for HTML3, ESCAPE_HTML4 for HTML 4, and ESCAPE_JAVA for Java. Likewise, some
of the important ones are UNESCAPE_CSV for CSV, UNESCAPE_HTML3 for HTML3,
UNESCAPE_HTML4 for HTML 4, and UNESCAPE_JAVA for Java.
he methods for escape sequences are as follows:

◾ escapeCsv(String input) method returns a string value for a CSV column enclosed

in double quotes, if required.
escapeEcmaScript(String input)

◾

method escapes the characters in a string using

EcmaScript string rules.
escapeHtml4(String

◾ input) method escapes the characters in a string using

HTML entities.
escapeJava(String ◾ input) method escapes the characters in a string using Java

string rules.
escapeXml(String ◾

input) method escapes the characters in a string using XML

entities.

Likewise, the methods for unescape sequences are as follows:

◾ unescapeCsv(String input) method returns a string value for an unescaped

CSV column.
unescapeEcmaScript(String ◾ input) method unescapes any EcmaScript literals

found in the string.
unescapeHtml4(String input)

◾ method unescapes a string containing entity escapes

to a string containing the actual Unicode characters corresponding to the escapes.
unescapeJava(String input)

◾ method unescapes any Java literals found in the

string.
unescapeXml(String input) ◾ method unescapes a string containing XML entity

escapes to a string containing the actual Unicode characters corresponding to the escapes.

10.2.3.3 URLEncode/URLDecode
URL encoding is the process of converting string into valid URL format. Valid URL format
means that the URL contains only what is termed “alpha / digit / safe / extra / escape” characters.
URL encoding is normally performed to convert data passed via HTML forms, because such data
may contain special character, such as “/”, “.”, “#”, and so on, which could have special meanings,
be an invalid character for an URL, or be altered during transfer.
he URLEncoder class from the java.net package is a utility class for HTML form encoding.
his class provides two static encode() methods for converting a string to the application/
x-www-form-urlencoded MIME format.
When encoding a string, note that the following rules apply:

◾ he alphanumeric characters a through z , A through Z , and 0 through 9 remain the same.

he special characters “.”, “-”, “*”, and “_” remain the same.

◾

◾

he space character “ ” is converted into a plus sign “+”.