...do real world Spring web apps really use unsanitized user input with "expression language" queries? (or am I totally missing the point? - not a Spring guy, I admit, but it all reads weird to me)
if i give my name as "$account.increment" then the worst you would expect to happen is that when my name is displayed it appears as "$account.increment". right?
in steps:
the jsp page contains <cout value="$user">
el looks at $user and finds the text "$account.increment" and *displays* that.
but no - there is the possibility that instead of simply displaying the value, spring will (may - i don't understand exactly when this is triggered) evaluate it. in steps:
the jsp page contains <cout value="$user">
el looks at $user and finds the text "$account.increment".
el *evaluates* $account.increment and increments the account. PLOP!
el displays the result of evaluating the account.
see, for example https://docs.google.com/document/d/1dc1xxO8UMFaGLOwgkykYdghG...