title: Cross Site Scripting issue
body: <p>To solve the cross site scripting issue, I used the following code to escape special characters:</p>
  
  <pre><code>    &lt;%@ taglib uri="http://java.sun.com/jsp/jstl/core" prefix="c" %&gt;
      &lt;%@ taglib uri="http://java.sun.com/jsp/jstl/functions" prefix="fn"%&gt;
      &lt;c:set var="linkParam" value="${fn:escapeXml(linkParam)}" /&gt;
  </code></pre>
  
  <p>And when run the code, I can see special character is escaped in page source:</p>
  
  <pre><code>    &lt;a href='/result.jsp?name=O&amp;#39;Neil'&gt;O'Neil&lt;/a&gt;
  </code></pre>
  
  <p>But when clicked the link, browser still show the "/result.jsp?name=O'Neil' in address bar, any idea?</p>