简体   繁体   English

我们可以在 Javascript 中使用 scriptlet 吗?

[英]Can we use scriptlets inside Javascript?

Here is my Code:这是我的代码:

<%@page contentType="text/html"%>
<%@page pageEncoding="UTF-8"%>
<%@page import="java.sql.*"%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>Example of Java Server Page with JDBC</title>
    </head>
<script>
function myFunction() {
    var x='<% request.getParameter("ServerName"); %>';
    alert(x);
</script>
<body>
<form>
    ServerName:  <input type="text" name="ServerName"   required> <br><br>
<input type="submit" id="btnSubmit" name="btnSubmit" />
            </div>
            </form>
  </body>
</html>

Here in the above function onclick of a button i want to execute the scriptlets which is inside javascript?在上面的函数 onclick 中,我想执行 javascript 中的 scriptlets?

It sounds like you are placing the JSP code within a JavaScript page, or at least in a non-JSP page. 听起来您是将JSP代码放在JavaScript页面中,或者至少是在非JSP页面中。 Scriptlets can only be included in a JSP page (typically configured to be *.jsp). 脚本只能包含在JSP页面中(通常配置为* .jsp)。

The statement as presented, if processed by the JSP compiler, would result in myVar being equal to '' as the scriptlet format you are using <% ... %> executes Java code between the tags, but does not return a result. 所提供的语句如果由JSP编译器处理,将导致myVar等于”,因为您正在使用的<%...%>的scriptlet格式在标记之间执行Java代码,但不会返回结果。

So, to use this tag you would need to manually write a value to the request output stream. 因此,要使用此标记,您需要手动将一个值写入请求输出流。 To get the desired functionality you need to do the following: 要获得所需的功能,您需要执行以下操作:

make sure your code is in a JSP page, if yes then 确保您的代码在JSP页面中,如果是,则

function myFunction() {
    var x= '&lt;%= request.getContextPath() %&gt;'; //(note the equals sign)
    alert(x);
}

With all that said, scriptlets are viewed as bad practice in most cases. 综上所述,在大多数情况下,scriptlet被视为不良做法。 For most cases, your should be using JSTL expressions and custom tags. 在大多数情况下,您应该使用JSTL表达式和自定义标签。

you can also use this: 您还可以使用以下命令:

<%@page contentType="text/html"%>
<%@page pageEncoding="UTF-8"%>
<%@page import="java.sql.*"%>
<%
String ServerName = (String)request.getParameter("ServerName");
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
   "http://www.w3.org/TR/html4/loose.dtd">
<html>
    <head>
        <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
        <title>Example of Java Server Page with JDBC</title>
    </head>
<script>
function myFunction() {
    var x='<%=ServerName%>';
    alert(x);
</script>
<body>

    ServerName:  <input type="text" name="ServerName"   required> <br><br>
<input type="submit" id="btnSubmit" name="btnSubmit" />
            </div>
            </form>
  </body>
</html>

You can, but if you want the result to be passed to the JavaScript you have to output something. 可以,但是如果要将结果传递到JavaScript,则必须输出一些内容。

var x='<%= request.getParameter("ServerName"); %>';
         ^ output!

… and unless you take measures to escape that data, you render yourself vulnerable to XSS attacks. …除非采取措施逃避该数据,否则您将很容易受到XSS攻击。

(And, obviously, this won't work until the form is actually submitted) (而且,显然,这要等到实际提交表单后才能生效)

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM