JSF and HTML code returned as a String from Managed Bean possible?

Question

In a previous web app I had made, I had used a String stored in my Managed bean to store a table in HTML, and returned it using a textOutput using JSF. I was wondering if this is possible with the HTML being returned containing JSF tags as well. For example:

My Managed Bean:

@ManagedBean(name = "account")
@ViewScoped
public class Account{

String subForm = "";

/* getters and setters */

public String login()
{   
    boolean a = true;

    subForm = "<div id='userdivcor' class='form-inline has-success'>"
    + "<h:inputText id='corruser' type='text' value='#{account.username}'/>"
    + "</div>";

    return "loginError.xhtml";

}

My .xhtml file:

//some code leading to my form
<h:form id='form' method='post' onsubmit='return fullCheck()'>
    <h:outputText id="htmlStuffTwo" value="#{account.subForm}" escape="false"/> 
</h:form>
//remainder of code

Using h:outputText, could I render my returned String value without any errors? Currently, I am trying this on a larger scale, but when the text goes to render, my value is something crazy like:

 "hdOMomYGEH3QfwJfNhPPECOG2Pv3gt/2F1n7dFGGp6ItPlhzDREjEJTSax3NjvsVDdiBZQsB"

Just curious, please let me know!

meriton meriton · Accepted Answer · 2014-08-21T17:25:49

No; JSF tags are interpreted on the server, but the content of a h:outputText is sent to the browser.

It is also worth noting that your current approach must disable HTML escaping to work, which is a security vulnerability if your table also contains user-supplied data.

The usual way is to have the tabular data in the backing bean, and use iterating jsf components such as a h:datatable (or its equivalent from whatever component library you are using), ui:repeat, or c:foreach to render the table.

JSF and HTML code returned as a String from Managed Bean possible?

1 Answers