How to transfer java array to javaScript array using jsp?

Question

I have a list of strings on my server which I am trying to get to the client in the form of an array. The code I am attempting to use is the following:

Within the jsp I have a List<String> column

I am attempting the following code:

<%int j = 0; %>
for(var i = 0; i < <%=columns.size()%>; i++)
{
  colArray[i] = "<%=columns.get(j++)%>";
}

This code simply returns the first element in the columns list for every element in the colArray.

I have also tried:

colArray = <%=columns.toArray()%>;

which does not work either. I feel like I am making a little mistake somewhere and am just not seeing it. Is what I am trying to do possible in the way that I am attempting?

Thanks.

Answer 1

You're getting the JSP code that is executed on the server mixed up with the JavaScript code that's executed on the client. The snippet <%=columns.get(j++)%> is executed once, on the server, and the JavaScript loop around it is irrelevant at this point. When it arrives the the client, the loop's body just says colArray[i] = "first entry"; which of course puts the same string into every element of the array.

What you need to do instead is to have a loop execute on the server, like this:

<% for (int i=0; i<columns.size(); i++) { %>
colArray[<%= i %>] = "<%= columns.get(i) %>"; 
<% } %>

My JSP skills are rusty, and the syntax may be different, but I hope you get the idea.

Edit: As was pointed out in the comments, you need to be VERY careful about escaping anything in those Strings that could cause them to be interpreted as JavaScript code (most prominently quotation marks) - especially if they contain user-generated content. Otherwise you're leaving your app wide open to Cross-site scripting and Cross-site request forgery attacks.