一. Spring框架防XXS跨站攻击

<context-param>

   <param-name>defaultHtmlEscape</param-name>

   <param-value>true</param-value>

</context-param>

 <spring：htmlEscape defaultHtmlEscape="true" />

<form:input path="someFormField" htmlEscape="true" />

<form:form htmlEscape="true">

<c:out value="${formulario}" escapeXml="true" />默认
escapeXml
就为true
或
${fn:escapeXml(param.nextUrl)}