JSP Best Practices

I'm thinking of giving a talk on JSP best practices. We recently had a couple developers give an excellent talk on CSS and best practices and many of the concepts have corollaries in the underlying JSP rendering of a page. So I thought I start to gather some thoughts in this blog posting:

1. Your JSP page should be valid XML


2. Avoid Scriptlets and JSP directives <% ... %>


3. Use ${fn:escapeXml(...)} frequently, even if you know the data is safe


4. Use <c:url> tag properly, including it's nested <c:param> tag so that URLs are properly encoded.


5. Do not put your URL parameters within the <c:url> tag, put them in nested <c:param> tags.


6. Use the proper and most recent standard JSTL taglibs. Globally replace all old JSTL taglib declarations so you don't have a mix of them floating around.


7. Don't store your own copy of the standard JSTL tld files, they will inevitably end up out of sync with the JAR file you are using.


8. Validate the rendered HTML content


9. Open your JSP page in an XML editor to validate it


10. Differences between <% include %>, <js:include>, and <c:import>


11. Page scope for <c:forEach> tag variables and how to pass them to included or imported pages


12. Parameterizing include/imported JSP fragments


13. Naming standards for JSP page and fragments


14. Using a main page template


15. Using value objects so JSP fragments can be reused


16. Precompile your JSPs