JSTL JSP Standard Tag Library

Dependencies and Taglib URIs

JSTL provides standard tags for output, conditions, iteration, URLs, formatting, functions, and XML/SQL legacy tasks. Use the core, formatting, and functions libraries with EL to keep Java control flow out of JSP.

JSTL must be available to the deployed application unless the container supplies it. Match the Jakarta Tags version and URI to the Servlet/JSP container. Current Jakarta Tags commonly use jakarta.tags.core, jakarta.tags.fmt, and jakarta.tags.functions; older Java EE applications use the historical java.sun.com URIs.

A taglib directive binds a prefix for one page. Use conventional prefixes c, fmt, and fn so readers recognize the library. A missing implementation, incompatible API namespace, or incorrect URI produces translation or class-loading errors.

Core Tags

c:out renders a value and can XML-escape markup-sensitive characters. c:if handles one conditional branch; c:choose, c:when, and c:otherwise model exclusive alternatives. c:forEach iterates collections, arrays, maps, ranges, and tokenized values, while varStatus exposes index, count, first, and last.

c:set and c:remove mutate scoped attributes, but heavy state construction belongs in the controller. c:catch can capture a tag exception, yet broad exception swallowing in a view hides defects; use normal application error handling for operational failures.

URLs, Formatting, and Functions

c:url creates context-aware URLs and c:param encodes query parameters. Use it instead of hardcoding the deployment context. c:redirect exists, but redirect decisions normally belong in a controller before rendering starts.

fmt tags format numbers and dates and support message bundles and locale selection. Keep canonical values typed in the model and format only for display. The fn library offers string and collection helpers such as length, contains, startsWith, split, join, and escapeXml; long transformation pipelines are a sign that the controller should prepare a view value.

Security and Data Boundaries

JSTL is not an authorization layer. Hiding a button with c:if does not prevent a direct request to the protected operation. Enforce authentication, tenant access, object ownership, and write permissions in trusted Java code.

Use context-appropriate output encoding. c:out is suitable for ordinary HTML text, but values inserted into JavaScript, CSS, HTML attributes, or URLs require the encoding rules for that context. Avoid composing executable code from untrusted values inside JSP.

Render a Product List

<%@ taglib prefix="c" uri="jakarta.tags.core" %>
      <%@ taglib prefix="fmt" uri="jakarta.tags.fmt" %>

      <c:choose>
        <c:when test="${empty requestScope.products}">
          <p>No products found.</p>
        </c:when>
        <c:otherwise>
          <ul>
            <c:forEach var="product" items="${requestScope.products}">
              <li>
                <c:out value="${product.name}" />
                <fmt:formatNumber value="${product.price}" type="currency" />
              </li>
            </c:forEach>
          </ul>
        </c:otherwise>
      </c:choose>

Context-Aware Link

<c:url var="detailsUrl" value="/products/details">
        <c:param name="id" value="${product.id}" />
      </c:url>
      <a href="${detailsUrl}">View details</a>

Before you move on