Q:	Q: Which HTML special characters are converted?
A:	A: It turns out this conversion is rather simple. There are only five characters that require escaping: <, >, &, and the two quote symbols, single and double ". All of these are converted into the equivalent HTML entities. For example, < becomes &lt;, & becomes &amp;, and so on.
Q:	Q: Last month my company hired a web consultant to audit our web application. She noticed that we were using EL everywhere to output strings entered by users. She said this was a security risk and recommended we output all user strings using the c:out tag. What gives?
A:	A: Your consultant was right. The security risk she is referring to is called cross-site hacking or cross-site scripting. The attack is sent from one user to another user’s web browser using your webapp as the delivery mechanism.
Q:	Q: What happens if value of the EL expression is null?
A:	A: Good question. You know an EL expression ${evalsToNull} generates an empty string in the response output, and so will <c:out value="${evalsToNull}"/>. But that’s not the end of the story with c:out. The c:out tag is smart, and it recognizes when the value is null and can perform a special action. That action is to provide a default value...