public abstract class BaseController {

/**

* 初始化数据绑定

* 1. 将所有传递进来的String进行HTML编码，防止XSS攻击

* 2. 将字段中Date类型转换为String类型

*/

@InitBinder

protected void initBinder(WebDataBinder binder) {

// String类型转换，将所有传递进来的String进行HTML编码，防止XSS攻击

        binder.registerCustomEditor(String.class, new PropertyEditorSupport() {

            @Override

            public void setAsText(String text) {

                setValue(text == null ? null : StringEscapeUtils.escapeHtml4(text.trim()));

            }

            @Override

            public String getAsText() {

                Object value = getValue();

                return value != null ? value.toString() : "";

            }

        });

        //……

}    

<div class="control-group">

	<label class="control-label">商品详情：</label>

	<div class="controls">

		<form:textarea id="detail"  path="detail" htmlEscape="true" rows="4" maxlength="1024" class="input-xxlarge "/>

		<sys:ckeditor replace="detail" uploadPath="/cms/article" />

	</div>

</div>