Package org.apache.commons.lang

Class StringEscapeUtils

  • @Deprecated(since="2021-04-30")
public class StringEscapeUtils
extends java.lang.Object
    Deprecated.
    Commons Lang 2 is in maintenance mode. Commons Lang 3 should be used instead.

    Escapes and unescapes Strings for Java, Java Script, HTML, XML, and SQL.

    #ThreadSafe#

    Since:
    2.0

    • Constructor Summary

      Constructors 
      Constructor Description
      StringEscapeUtils()
      Deprecated.
      StringEscapeUtils instances should NOT be constructed in standard programming.

    • Method Summary

      All Methods Static Methods Concrete Methods Deprecated Methods 
      Modifier and Type Method Description
      static void escapeCsv​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Writes a String value for a CSV column enclosed in double quotes, if required.
      static java.lang.String escapeCsv​(java.lang.String str)
      Deprecated.
      Returns a String value for a CSV column enclosed in double quotes, if required.
      static void escapeHtml​(java.io.Writer writer, java.lang.String string)
      Deprecated.
      Escapes the characters in a String using HTML entities and writes them to a Writer.
      static java.lang.String escapeHtml​(java.lang.String str)
      Deprecated.
      Escapes the characters in a String using HTML entities.
      static void escapeJava​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Escapes the characters in a String using Java String rules to a Writer.
      static java.lang.String escapeJava​(java.lang.String str)
      Deprecated.
      Escapes the characters in a String using Java String rules.
      static void escapeJavaScript​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Escapes the characters in a String using JavaScript String rules to a Writer.
      static java.lang.String escapeJavaScript​(java.lang.String str)
      Deprecated.
      Escapes the characters in a String using JavaScript String rules.
      static java.lang.String escapeSql​(java.lang.String str)
      Deprecated.
      Escapes the characters in a String to be suitable to pass to an SQL query.
      static void escapeXml​(java.io.Writer writer, java.lang.String str)
      Deprecated.
      Escapes the characters in a String using XML entities.
      static java.lang.String escapeXml​(java.lang.String str)
      Deprecated.
      Escapes the characters in a String using XML entities.
      static void unescapeCsv​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Returns a String value for an unescaped CSV column.
      static java.lang.String unescapeCsv​(java.lang.String str)
      Deprecated.
      Returns a String value for an unescaped CSV column.
      static void unescapeHtml​(java.io.Writer writer, java.lang.String string)
      Deprecated.
      Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes.
      static java.lang.String unescapeHtml​(java.lang.String str)
      Deprecated.
      Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes.
      static void unescapeJava​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Unescapes any Java literals found in the String to a Writer.
      static java.lang.String unescapeJava​(java.lang.String str)
      Deprecated.
      Unescapes any Java literals found in the String.
      static void unescapeJavaScript​(java.io.Writer out, java.lang.String str)
      Deprecated.
      Unescapes any JavaScript literals found in the String to a Writer.
      static java.lang.String unescapeJavaScript​(java.lang.String str)
      Deprecated.
      Unescapes any JavaScript literals found in the String.
      static void unescapeXml​(java.io.Writer writer, java.lang.String str)
      Deprecated.
      Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.
      static java.lang.String unescapeXml​(java.lang.String str)
      Deprecated.
      Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

      • Methods inherited from class java.lang.Object

        equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Constructor Detail

      • StringEscapeUtils

        public StringEscapeUtils()
        Deprecated.

        StringEscapeUtils instances should NOT be constructed in standard programming.

        Instead, the class should be used as: 

        StringEscapeUtils.escapeJava("foo");

        This constructor is public to permit tools that require a JavaBean instance to operate.

    • Method Detail

      • escapeJava

        public static java.lang.String escapeJava​(java.lang.String str)
        Deprecated.

        Escapes the characters in a String using Java String rules.

        Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)

        So a tab becomes the characters '\\' and 't'.

        The only difference between Java strings and JavaScript strings is that in JavaScript, a single quote must be escaped.

        Example: 

         input string: He didn't say, "Stop!"
 output string: He didn't say, \"Stop!\"

        Parameters:
        str - String to escape values in, may be null
        Returns:
        String with escaped values, null if null string input

      • escapeJava

        public static void escapeJava​(java.io.Writer out,
                              java.lang.String str)
                       throws java.io.IOException
        Deprecated.

        Escapes the characters in a String using Java String rules to a Writer.

        A null string input has no effect.

        Parameters:
        out - Writer to write escaped string into
        str - String to escape values in, may be null
        Throws:
        java.lang.IllegalArgumentException - if the Writer is null
        java.io.IOException - if error occurs on underlying Writer
        See Also:
        escapeJava(java.lang.String)

      • escapeJavaScript

        public static java.lang.String escapeJavaScript​(java.lang.String str)
        Deprecated.

        Escapes the characters in a String using JavaScript String rules.

        Escapes any values it finds into their JavaScript String form. Deals correctly with quotes and control-chars (tab, backslash, cr, ff, etc.)

        So a tab becomes the characters '\\' and 't'.

        The only difference between Java strings and JavaScript strings is that in JavaScript, a single quote must be escaped.

        Example: 

         input string: He didn't say, "Stop!"
 output string: He didn\'t say, \"Stop!\"

        Parameters:
        str - String to escape values in, may be null
        Returns:
        String with escaped values, null if null string input

      • escapeJavaScript

        public static void escapeJavaScript​(java.io.Writer out,
                                    java.lang.String str)
                             throws java.io.IOException
        Deprecated.

        Escapes the characters in a String using JavaScript String rules to a Writer.

        A null string input has no effect.

        Parameters:
        out - Writer to write escaped string into
        str - String to escape values in, may be null
        Throws:
        java.lang.IllegalArgumentException - if the Writer is null
        java.io.IOException - if error occurs on underlying Writer
        See Also:
        escapeJavaScript(java.lang.String)

      • unescapeJava

        public static java.lang.String unescapeJava​(java.lang.String str)
        Deprecated.

        Unescapes any Java literals found in the String. For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

        Parameters:
        str - the String to unescape, may be null
        Returns:
        a new unescaped String, null if null string input

      • unescapeJava

        public static void unescapeJava​(java.io.Writer out,
                                java.lang.String str)
                         throws java.io.IOException
        Deprecated.

        Unescapes any Java literals found in the String to a Writer.

        For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

        A null string input has no effect.

        Parameters:
        out - the Writer used to output unescaped characters
        str - the String to unescape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the Writer is null
        java.io.IOException - if error occurs on underlying Writer

      • unescapeJavaScript

        public static java.lang.String unescapeJavaScript​(java.lang.String str)
        Deprecated.

        Unescapes any JavaScript literals found in the String.

        For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

        Parameters:
        str - the String to unescape, may be null
        Returns:
        A new unescaped String, null if null string input
        See Also:
        unescapeJava(String)

      • unescapeJavaScript

        public static void unescapeJavaScript​(java.io.Writer out,
                                      java.lang.String str)
                               throws java.io.IOException
        Deprecated.

        Unescapes any JavaScript literals found in the String to a Writer.

        For example, it will turn a sequence of '\' and 'n' into a newline character, unless the '\' is preceded by another '\'.

        A null string input has no effect.

        Parameters:
        out - the Writer used to output unescaped characters
        str - the String to unescape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the Writer is null
        java.io.IOException - if error occurs on underlying Writer
        See Also:
        unescapeJava(Writer,String)

      • escapeHtml

        public static void escapeHtml​(java.io.Writer writer,
                              java.lang.String string)
                       throws java.io.IOException
        Deprecated.

        Escapes the characters in a String using HTML entities and writes them to a Writer.

        For example:

        "bread" & "butter"

        becomes:

        "bread" & "butter".

        Supports all known HTML 4.0 entities, including funky accents. Note that the commonly used apostrophe escape character (') is not a legal entity and so is not supported).

        Parameters:
        writer - the writer receiving the escaped string, not null
        string - the String to escape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the writer is null
        java.io.IOException - when Writer passed throws the exception from calls to the Writer.write(int) methods.
        See Also:
        escapeHtml(String), unescapeHtml(String), ISO Entities, HTML 3.2 Character Entities for ISO Latin-1, HTML 4.0 Character entity references, HTML 4.01 Character References, HTML 4.01 Code positions

      • unescapeHtml

        public static java.lang.String unescapeHtml​(java.lang.String str)
        Deprecated.

        Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes. Supports HTML 4.0 entities.

        For example, the string "&lt;Fran&ccedil;ais&gt;" will become "<Français>"

        If an entity is unrecognized, it is left alone, and inserted verbatim into the result string. e.g. "&gt;&zzzz;x" will become ">&zzzz;x".

        Parameters:
        str - the String to unescape, may be null
        Returns:
        a new unescaped String, null if null string input
        See Also:
        escapeHtml(Writer, String)

      • unescapeHtml

        public static void unescapeHtml​(java.io.Writer writer,
                                java.lang.String string)
                         throws java.io.IOException
        Deprecated.

        Unescapes a string containing entity escapes to a string containing the actual Unicode characters corresponding to the escapes. Supports HTML 4.0 entities.

        For example, the string "&lt;Fran&ccedil;ais&gt;" will become "<Français>"

        If an entity is unrecognized, it is left alone, and inserted verbatim into the result string. e.g. "&gt;&zzzz;x" will become ">&zzzz;x".

        Parameters:
        writer - the writer receiving the unescaped string, not null
        string - the String to unescape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the writer is null
        java.io.IOException - if an IOException occurs
        See Also:
        escapeHtml(String)

      • escapeXml

        public static void escapeXml​(java.io.Writer writer,
                             java.lang.String str)
                      throws java.io.IOException
        Deprecated.

        Escapes the characters in a String using XML entities.

        For example: "bread" & "butter" => &quot;bread&quot; &amp; &quot;butter&quot;.

        Supports only the five basic XML entities (gt, lt, quot, amp, apos). Does not support DTDs or external entities.

        Note that unicode characters greater than 0x7f are currently escaped to their numerical \\u equivalent. This may change in future releases.

        Parameters:
        writer - the writer receiving the unescaped string, not null
        str - the String to escape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the writer is null
        java.io.IOException - if there is a problem writing
        See Also:
        unescapeXml(java.lang.String)

      • escapeXml

        public static java.lang.String escapeXml​(java.lang.String str)
        Deprecated.

        Escapes the characters in a String using XML entities.

        For example: "bread" & "butter" => &quot;bread&quot; &amp; &quot;butter&quot;.

        Supports only the five basic XML entities (gt, lt, quot, amp, apos). Does not support DTDs or external entities.

        Note that unicode characters greater than 0x7f are currently escaped to their numerical \\u equivalent. This may change in future releases.

        Parameters:
        str - the String to escape, may be null
        Returns:
        a new escaped String, null if null string input
        See Also:
        unescapeXml(java.lang.String)

      • unescapeXml

        public static void unescapeXml​(java.io.Writer writer,
                               java.lang.String str)
                        throws java.io.IOException
        Deprecated.

        Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

        Supports only the five basic XML entities (gt, lt, quot, amp, apos). Does not support DTDs or external entities.

        Note that numerical \\u unicode codes are unescaped to their respective unicode characters. This may change in future releases.

        Parameters:
        writer - the writer receiving the unescaped string, not null
        str - the String to unescape, may be null
        Throws:
        java.lang.IllegalArgumentException - if the writer is null
        java.io.IOException - if there is a problem writing
        See Also:
        escapeXml(String)

      • unescapeXml

        public static java.lang.String unescapeXml​(java.lang.String str)
        Deprecated.

        Unescapes a string containing XML entity escapes to a string containing the actual Unicode characters corresponding to the escapes.

        Supports only the five basic XML entities (gt, lt, quot, amp, apos). Does not support DTDs or external entities.

        Note that numerical \\u unicode codes are unescaped to their respective unicode characters. This may change in future releases.

        Parameters:
        str - the String to unescape, may be null
        Returns:
        a new unescaped String, null if null string input
        See Also:
        escapeXml(String)

      • escapeSql

        public static java.lang.String escapeSql​(java.lang.String str)
        Deprecated.

        Escapes the characters in a String to be suitable to pass to an SQL query.

        For example, 

        statement.executeQuery("SELECT * FROM MOVIES WHERE TITLE='" +
   StringEscapeUtils.escapeSql("McHale's Navy") +
   "'");

        At present, this method only turns single-quotes into doubled single-quotes ("McHale's Navy" => "McHale''s Navy"). It does not handle the cases of percent (%) or underscore (_) for use in LIKE clauses.

        see http://www.jguru.com/faq/view.jsp?EID=8881
        Parameters:
        str - the string to escape, may be null
        Returns:
        a new String, escaped for SQL, null if null string input

      • escapeCsv

        public static java.lang.String escapeCsv​(java.lang.String str)
        Deprecated.

        Returns a String value for a CSV column enclosed in double quotes, if required.

        If the value contains a comma, newline or double quote, then the String value is returned enclosed in double quotes.

        Any double quote characters in the value are escaped with another double quote.

        If the value does not contain a comma, newline or double quote, then the String value is returned unchanged.

        see Wikipedia and RFC 4180.
        Parameters:
        str - the input CSV column String, may be null
        Returns:
        the input String, enclosed in double quotes if the value contains a comma, newline or double quote, null if null string input
        Since:
        2.4

      • escapeCsv

        public static void escapeCsv​(java.io.Writer out,
                             java.lang.String str)
                      throws java.io.IOException
        Deprecated.

        Writes a String value for a CSV column enclosed in double quotes, if required.

        If the value contains a comma, newline or double quote, then the String value is written enclosed in double quotes.

        Any double quote characters in the value are escaped with another double quote.

        If the value does not contain a comma, newline or double quote, then the String value is written unchanged (null values are ignored).

        see Wikipedia and RFC 4180.
        Parameters:
        str - the input CSV column String, may be null
        out - Writer to write input string to, enclosed in double quotes if it contains a comma, newline or double quote
        Throws:
        java.io.IOException - if error occurs on underlying Writer
        Since:
        2.4

      • unescapeCsv

        public static java.lang.String unescapeCsv​(java.lang.String str)
        Deprecated.

        Returns a String value for an unescaped CSV column.

        If the value is enclosed in double quotes, and contains a comma, newline or double quote, then quotes are removed.

        Any double quote escaped characters (a pair of double quotes) are unescaped to just one double quote.

        If the value is not enclosed in double quotes, or is and does not contain a comma, newline or double quote, then the String value is returned unchanged.

        see Wikipedia and RFC 4180.
        Parameters:
        str - the input CSV column String, may be null
        Returns:
        the input String, with enclosing double quotes removed and embedded double quotes unescaped, null if null string input
        Since:
        2.4

      • unescapeCsv

        public static void unescapeCsv​(java.io.Writer out,
                               java.lang.String str)
                        throws java.io.IOException
        Deprecated.

        Returns a String value for an unescaped CSV column.

        If the value is enclosed in double quotes, and contains a comma, newline or double quote, then quotes are removed.

        Any double quote escaped characters (a pair of double quotes) are unescaped to just one double quote.

        If the value is not enclosed in double quotes, or is and does not contain a comma, newline or double quote, then the String value is returned unchanged.

        see Wikipedia and RFC 4180.
        Parameters:
        str - the input CSV column String, may be null
        out - Writer to write the input String to, with enclosing double quotes removed and embedded double quotes unescaped, null if null string input
        Throws:
        java.io.IOException - if error occurs on underlying Writer
        Since:
        2.4