Top Description Fields Constructors Methods
org.springframework.web.util

public abstract Class HtmlUtils

extends Object
Class Inheritance
Imports
org.springframework.util.Assert
Utility class for HTML escaping.

Escapes and unescapes based on the W3C HTML 4.01 recommendation, handling character entity references.

Reference: https://www.w3.org/TR/html4/charset.html

For a comprehensive set of String escaping utilities, consider Apache Commons Text and its StringEscapeUtils class. We do not use that class here in order to avoid a runtime dependency on Commons Text just for HTML escaping. Furthermore, Spring's HTML escaping is more flexible and 100% HTML 4.0 compliant.

Authors
Juergen Hoeller, Martin Kersten, Craig Andrews
Since
01.03.2003

Field Summary

Modifier and TypeField and Description
private static final HtmlCharacterEntityReferences
characterEntityReferences

Shared instance of pre-parsed HTML character entity references.

Constructor Summary

AccessConstructor and Description
public
HtmlUtils()

Method Summary

Modifier and TypeMethod and Description
public static String

Returns:

the escaped string
htmlEscape(String
the (unescaped) input string
input)

Turn special characters into HTML character references.

public static String

Returns:

the escaped string
htmlEscape(String
the (unescaped) input string
input, String
the name of a supported charset
encoding)

Turn special characters into HTML character references.

public static String

Returns:

the escaped string
htmlEscapeDecimal(String
the (unescaped) input string
input)

Turn special characters into HTML character references.

public static String

Returns:

the escaped string
htmlEscapeDecimal(String
the (unescaped) input string
input, String
the name of a supported charset
encoding)

Turn special characters into HTML character references.

public static String

Returns:

the escaped string
htmlEscapeHex(String
the (unescaped) input string
input)

Turn special characters into HTML character references.

public static String

Returns:

the escaped string
htmlEscapeHex(String
the (unescaped) input string
input, String
the name of a supported charset
encoding)

Turn special characters into HTML character references.

public static String

Returns:

the unescaped string
htmlUnescape(String
the (escaped) input string
input)

Turn HTML character references into their plain text UNICODE equivalent.

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

characterEntityReferencesback to summary
private static final HtmlCharacterEntityReferences characterEntityReferences

Shared instance of pre-parsed HTML character entity references.

Constructor Detail

HtmlUtilsback to summary
public HtmlUtils()

Method Detail

htmlEscapeback to summary
public static String htmlEscape(String input)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding entity reference (e.g. <).

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

Returns:String

the escaped string

htmlEscapeback to summary
public static String htmlEscape(String input, String encoding)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding entity reference (e.g. <) at least as required by the specified encoding. In other words, if a special character does not have to be escaped for the given encoding, it may not be.

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

encoding:String

the name of a supported charset

Returns:String

the escaped string

Since
4.1.2
htmlEscapeDecimalback to summary
public static String htmlEscapeDecimal(String input)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding numeric reference in decimal format (&#Decimal;).

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

Returns:String

the escaped string

htmlEscapeDecimalback to summary
public static String htmlEscapeDecimal(String input, String encoding)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding numeric reference in decimal format (&#Decimal;) at least as required by the specified encoding. In other words, if a special character does not have to be escaped for the given encoding, it may not be.

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

encoding:String

the name of a supported charset

Returns:String

the escaped string

Since
4.1.2
htmlEscapeHexback to summary
public static String htmlEscapeHex(String input)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding numeric reference in hex format (&#xHex;).

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

Returns:String

the escaped string

htmlEscapeHexback to summary
public static String htmlEscapeHex(String input, String encoding)

Turn special characters into HTML character references.

Handles the complete character set defined in the HTML 4.01 recommendation.

Escapes all special characters to their corresponding numeric reference in hex format (&#xHex;) at least as required by the specified encoding. In other words, if a special character does not have to be escaped for the given encoding, it may not be.

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (unescaped) input string

encoding:String

the name of a supported charset

Returns:String

the escaped string

Since
4.1.2
htmlUnescapeback to summary
public static String htmlUnescape(String input)

Turn HTML character references into their plain text UNICODE equivalent.

Handles complete character set defined in HTML 4.01 recommendation and all reference types (decimal, hex, and entity).

Correctly converts the following formats:

&#Entity; - (Example: &amp;) case sensitive &#Decimal; - (Example: &#68;)
&#xHex; - (Example: &#xE5;) case insensitive

Gracefully handles malformed character references by copying original characters as is when encountered.

Reference: https://www.w3.org/TR/html4/sgml/entities.html

Parameters
input:String

the (escaped) input string

Returns:String

the unescaped string