org.apache.commons.lang.StringEscapeUtils Java Examples

public static StringBuilder buildJSArrayString(ArrayList<GlossaryItem> glossaryItemArr) {
    StringBuilder sb = new StringBuilder();
    sb.append("new Array(");
    for (Iterator iterator = glossaryItemArr.iterator(); iterator.hasNext();) {
        GlossaryItem glossaryItem = (GlossaryItem) iterator.next();
        ArrayList<String> allHighlightStrings = glossaryItem.getAllStringsToMarkup();
        sb.append("new Array(\"");
        for (Iterator iterator2 = allHighlightStrings.iterator(); iterator2.hasNext();) {
            String termFlexionSynonym = StringEscapeUtils.escapeJava((String) iterator2.next());
            sb.append(termFlexionSynonym);
            sb.append("\"");
            if (iterator2.hasNext())
                sb.append(",\"");
        }
        sb.append(")");
        if (iterator.hasNext())
            sb.append(",");
    }

    sb.append(");");
    return sb;
}
 

@Override
public String scalar(Object value, Inspection options) {
    if(options.quote()) {
        if(value instanceof Character) {
            final char c = (char) value;
            switch(c) {
                case '\'': return "'\\''";
                case '"': return "'\"'";
                default: return "'" + StringEscapeUtils.escapeJava(String.valueOf(c)) + "'";
            }
        } else if(value instanceof String) {
            return "\"" + StringEscapeUtils.escapeJava((String) value) + "\"";
        }
    }

    if(value instanceof Class) {
        // Short class names are usually enough
        return ((Class) value).getSimpleName();
    }

    // everything else
    return String.valueOf(value);
}
 

public RCFileScanner(final Configuration conf, final Schema schema, final TableMeta meta, final FileFragment fragment)
     throws IOException {
   super(conf, meta, schema, fragment);

   this.start = fragment.getStartKey();
   this.end = start + fragment.getEndKey();
   key = new LongWritable();
   column = new BytesRefArrayWritable();

   String nullCharacters = StringEscapeUtils.unescapeJava(this.meta.getOption(NULL));
   if (StringUtils.isEmpty(nullCharacters)) {
     nullChars = NullDatum.get().asTextBytes();
   } else {
     nullChars = nullCharacters.getBytes();
   }
}
 

@Override
public SimpleFacetQuery convert(SOURCE request) {
  String fromValue = StringUtils.isNotEmpty(request.getFrom()) ? request.getFrom() : "*";
  String toValue = StringUtils.isNotEmpty(request.getTo()) ? request.getTo() : "*";
  Criteria criteria = new SimpleStringCriteria("*:*");
  SimpleFacetQuery facetQuery = new SimpleFacetQuery();
  facetQuery.addCriteria(criteria);
  SimpleFilterQuery simpleFilterQuery = new SimpleFilterQuery();
  simpleFilterQuery.addCriteria(new SimpleStringCriteria(getDateTimeField() + ":[" + fromValue +" TO "+ toValue+ "]" ));
  facetQuery.addFilterQuery(simpleFilterQuery);
  FacetOptions facetOptions = new FacetOptions();
  facetOptions.setFacetMinCount(1);
  facetOptions.setFacetSort(getFacetSort());
  facetOptions.setFacetLimit(-1);
  appendFacetOptions(facetOptions, request);
  addIncludeFieldValues(facetQuery, StringEscapeUtils.unescapeXml(request.getIncludeQuery()));
  addExcludeFieldValues(facetQuery, StringEscapeUtils.unescapeXml(request.getExcludeQuery()));
  facetQuery.setFacetOptions(facetOptions);
  facetQuery.setRows(0);
  addComponentFilters(facetQuery, request);
  appendFacetQuery(facetQuery, request);
  addInFilterQuery(facetQuery, CLUSTER, splitValueAsList(request.getClusters(), ","));
  return facetQuery;
}
 

private boolean buildNameSearch(boolean hasAWhereClause, StringBuilder queryText, String searchString,
    String userAlias) {
if (!hasAWhereClause) {
    queryText.append(" WHERE ");
}
String[] tokens = searchString.trim().split("\\s+");
for (String token : tokens) {
    String escToken = StringEscapeUtils.escapeSql(token);
    if (hasAWhereClause) {
	queryText.append(" AND ");
    }
    queryText.append(" (").append(userAlias).append(".first_name LIKE '%").append(escToken).append("%' OR ")
	    .append(userAlias).append(".last_name LIKE '%").append(escToken).append("%' OR ").append(userAlias)
	    .append(".login LIKE '%").append(escToken).append("%') ");
}
return true;
   }
 

/**
 * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/>
 * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/>
 * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
 */
@Override
public String getParameter(String name) {
    if(("content".equals(name) || name.endsWith("WithHtml")) && !isIncludeRichText){
        return super.getParameter(name);
    }
    name = JsoupUtil.clean(name);
    String value = super.getParameter(name);
    if (Strings.isNotBlank(value)) {
        // HTML transformation characters
        value = JsoupUtil.clean(value);
        // SQL injection characters
        value = StringEscapeUtils.escapeSql(value);
    }
    return value;
}
 

/**
*/
  @Override
  public Object getValueAt(final int row, final int col) {
      final Object o = getObject(row);
      Object[] dataArray = null;
      dataArray = (Object[]) o;

      final Object groupColItem = dataArray[col];

      switch (col) {
      case 0:
          return groupColItem;
      case 1:
          return groupColItem;
      case 2:
          String name = ((BusinessGroup) groupColItem).getName();
          name = StringEscapeUtils.escapeHtml(name).toString();
          return name;
      case 3:
          return groupColItem;
      case 4:
          return groupColItem;
      default:
          return "error";
      }
  }
 

/**
 * Returns the name of the test containing this element, or null if it can't be calculated.
 */
@Nullable
public String findTestName(@Nullable PsiElement elt) {
  if (elt == null) return null;

  final DartCallExpression call = findEnclosingTestCall(elt, getTestsFromOutline(elt.getContainingFile()));
  if (call == null) return null;

  final DartStringLiteralExpression lit = DartSyntax.getArgument(call, 0, DartStringLiteralExpression.class);
  if (lit == null) return null;

  final String name = DartSyntax.unquote(lit);
  if (name == null) return null;

  return StringEscapeUtils.unescapeJava(name);
}
 

private boolean checkStorageInfoOrSendError(JNStorage storage,
    HttpServletRequest request, HttpServletResponse response)
    throws IOException {
  int myNsId = storage.getNamespaceID();
  String myClusterId = storage.getClusterID();
  
  String theirStorageInfoString = StringEscapeUtils.escapeHtml(
      request.getParameter(STORAGEINFO_PARAM));

  if (theirStorageInfoString != null) {
    int theirNsId = StorageInfo.getNsIdFromColonSeparatedString(
        theirStorageInfoString);
    String theirClusterId = StorageInfo.getClusterIdFromColonSeparatedString(
        theirStorageInfoString);
    if (myNsId != theirNsId || !myClusterId.equals(theirClusterId)) {
      String msg = "This node has namespaceId '" + myNsId + " and clusterId '"
          + myClusterId + "' but the requesting node expected '" + theirNsId
          + "' and '" + theirClusterId + "'";
      response.sendError(HttpServletResponse.SC_FORBIDDEN, msg);
      LOG.warn("Received an invalid request file transfer request from " +
          request.getRemoteAddr() + ": " + msg);
      return false;
    }
  }
  return true;
}
 

/**
 * XML-escaped or null if not exists.
 */
public String getProjektname()
{
  if (kost2 == null || kost2.getProjekt() == null) {
    return null;
  }
  return StringEscapeUtils.escapeXml(kost2.getProjekt().getName());
}
 

public void value(String v) throws IOException {
    StringBuilder buf = new StringBuilder(v.length());
    buf.append('\"');
    // TODO: remove when JENKINS-45099 has been fixed correctly in upstream stapler
    if (config.isHtmlEncode()) {
        jsonEncoder.quoteAsString(StringEscapeUtils.escapeHtml(v), buf);
    } else {
        jsonEncoder.quoteAsString(v, buf);
    }
    buf.append('\"');
    data(buf.toString());
}
 

/** {@inheritDoc} */
public ActionForward execute(ActionMapping mapping,
        ActionForm formIn,
        HttpServletRequest request,
        HttpServletResponse response) {

    if (!AclManager.hasAcl("user_role(org_admin)", request, null)) {
        //Throw an exception with a nice error message so the user
        //knows what went wrong.
        LocalizationService ls = LocalizationService.getInstance();
        PermissionException pex =
            new PermissionException("Only org admin's can reactivate users");
        pex.setLocalizedTitle(ls.getMessage("permission.jsp.title.enableuser"));
        pex.setLocalizedSummary(ls.getMessage("permission.jsp.summary.enableuser"));
        throw pex;
    }

    RequestContext requestContext = new RequestContext(request);

    Long uid = requestContext.getRequiredParam("uid");

    User user = UserManager.lookupUser(requestContext.getCurrentUser(), uid);
    request.setAttribute(RhnHelper.TARGET_USER, user);

    if (!user.isDisabled()) {
        ActionMessages msg = new ActionMessages();
        msg.add(ActionMessages.GLOBAL_MESSAGE,
            new ActionMessage("userenable.error.usernotdisabled",
               StringEscapeUtils.escapeHtml(user.getLogin())));
        getStrutsDelegate().saveMessages(request, msg);
    }

    return mapping.findForward(RhnHelper.DEFAULT_FORWARD);
}
 

@Override
public String toString() {
    
    String host = System.getProperty("jboss.host.name");
    
    return new StringBuilder().append("host:").append(host).append(", id:").append(this.getSettings().getId()).append(", query:")
                    .append(StringEscapeUtils.escapeHtml(this.getSettings().getQuery())).append(", auths:")
                    .append(this.getSettings().getQueryAuthorizations()).append(", user:").append(this.getSettings().getOwner()).append(", queryLogic:")
                    .append(this.getSettings().getQueryLogicName()).append(", name:").append(this.getSettings().getQueryName()).append(", pagesize:")
                    .append(this.getSettings().getPagesize()).append(", begin:").append(this.getSettings().getBeginDate()).append(", end:")
                    .append(this.getSettings().getEndDate()).append(", expiration:").append(this.getSettings().getExpirationDate()).append(", params: ")
                    .append(this.getSettings().getParameters()).append(", callTime: ")
                    .append((this.getTimeOfCurrentCall() == 0) ? 0 : System.currentTimeMillis() - this.getTimeOfCurrentCall()).toString();
    
}
 

private void displaySectionInfo(final StringOutput sb, final SectionContext sc, final AssessmentInstance ai, final IQComponent comp, final URLBuilder ubu,
        final Translator translator) {
    // display the sectionInfo
    if (sc == null) {
        return;
    }
    if (ai.isDisplayTitles()) {
        sb.append("<h3>" + StringEscapeUtils.escapeHtml(sc.getTitle()) + "</h3>");
    }
    final Objectives objectives = sc.getObjectives();
    if (objectives != null) {
        final StringBuilder sbTmp = new StringBuilder();
        final Resolver resolver = ai.getResolver();
        final RenderInstructions ri = new RenderInstructions();
        ri.put(RenderInstructions.KEY_STATICS_PATH, resolver.getStaticsBaseURI() + "/");
        objectives.render(sbTmp, ri);
        sb.append(sbTmp);
    }
    // if Menu not visible, or if visible but not selectable, and itemPage sequence (one question per page)
    // show button to navigate to the first question of the current section
    final IQMenuDisplayConf menuDisplayConfig = comp.getMenuDisplayConf();
    if (!menuDisplayConfig.isEnabledMenu() && menuDisplayConfig.isItemPageSequence()) {
        sb.append("<a class=\"b_button\" onclick=\"return o2cl()\" href=\"");
        ubu.buildURI(sb, new String[] { VelocityContainer.COMMAND_ID }, new String[] { "git" });
        final AssessmentContext ac = ai.getAssessmentContext();
        final int sectionPos = ac.getCurrentSectionContextPos();
        sb.append("?itid=" + 0 + "&seid=" + sectionPos);
        final String title = translator.translate("next");
        sb.append("\" title=\"" + StringEscapeUtils.escapeHtml(title) + "\">");
        sb.append("<span>").append(StringEscapeUtils.escapeHtml(title)).append("</title>");
        sb.append("</a>");
    }
}
 

protected String formatRow(String source, String sink) {
    String tempSource = source, tempSink = sink;
    if (normalizer != null) {
        tempSource = normalizer.normalize(tempSource);
        tempSink = normalizer.normalize(tempSink);
    }
    tempSource = StringEscapeUtils.escapeJava(tempSource);
    tempSink = StringEscapeUtils.escapeJava(tempSink);
    return tempSource + "\0" + tempSink;
}
 

private void buildNameSearch(String searchString, StringBuilder sqlBuilder) {
if (!StringUtils.isBlank(searchString)) {
    String[] tokens = searchString.trim().split("\\s+");
    for (String token : tokens) {
	String escToken = StringEscapeUtils.escapeSql(token);
	sqlBuilder.append(" WHERE (user.first_name LIKE '%").append(escToken)
		.append("%' OR user.last_name LIKE '%").append(escToken).append("%' OR user.login_name LIKE '%")
		.append(escToken).append("%') ");
    }
}
   }
 

public void doIt(int ix) throws JspException, IOException {
	JspWriter writer = pageContext.getOut();
	
	HarvestResult result = chain.get(ix);
	
	writer.println("<wct:HarvestResult>");
	writer.print("<wct:Creator>");
	writer.print(StringEscapeUtils.escapeXml(result.getCreatedBy().getUsername()) + " " + ix + "/" + chain.size());
	writer.println("</wct:Creator>");
	
	writer.print("<wct:CreationDate>");
	writer.print(dateFormatter.format(result.getCreationDate()));
	writer.println("</wct:CreationDate>");
	
	writer.print("<wct:ProvenanceNote>");
	writer.print(StringEscapeUtils.escapeXml(result.getProvenanceNote()));
	writer.println("</wct:ProvenanceNote>");

	if(!result.getModificationNotes().isEmpty()) {
		writer.println("<wct:ModificationNotes>");
		for(String note: result.getModificationNotes()) {
			writer.print("<wct:ModificationNote>");
			writer.print(StringEscapeUtils.escapeXml(note));
			writer.println("</wct:ModificationNote>");
		}
		writer.println("</wct:ModificationNotes>");
	}
	
	if((ix+1) < chain.size()) {
		writer.println("<wct:DerivedFrom>");
		doIt(ix+1);
		writer.println("</wct:DerivedFrom>");
	}
	
	writer.println("</wct:HarvestResult>");
}
 

/**
 * Return the field to index after having eventually removed the HTML tags.
 *
 * @return The text field to index
 */
@Override
public String getIndexeableFieldValue() {
    HtmlHandler htmlhandler = new HtmlHandler();
    String parsedText = htmlhandler.getParsedText(super.getText());
    return StringEscapeUtils.unescapeHtml(parsedText);
}
 

private String buildRow(Selection w, String lab, String cmd, Item item, State state, StringBuilder rowSB)
        throws RenderException {
    String mappedValue = null;
    String rowSnippet = getSnippet("selection_row");

    String command = cmd != null ? cmd : "";
    String label = lab;

    if (item instanceof NumberItem && ((NumberItem) item).getDimension() != null) {
        String unit = getUnitForWidget(w);
        command = StringUtils.replace(command, UnitUtils.UNIT_PLACEHOLDER, unit);
        label = StringUtils.replace(label, UnitUtils.UNIT_PLACEHOLDER, unit);
    }

    rowSnippet = StringUtils.replace(rowSnippet, "%item%", w.getItem() != null ? w.getItem() : "");
    rowSnippet = StringUtils.replace(rowSnippet, "%cmd%", StringEscapeUtils.escapeHtml(command));
    rowSnippet = StringUtils.replace(rowSnippet, "%label%",
            label != null ? StringEscapeUtils.escapeHtml(label) : "");

    State compareMappingState = state;
    if (state instanceof QuantityType) { // convert the item state to the command value for proper
                                         // comparison and "checked" attribute calculation
        compareMappingState = convertStateToLabelUnit((QuantityType<?>) state, command);
    }

    if (compareMappingState.toString().equals(command)) {
        mappedValue = label;
        rowSnippet = StringUtils.replace(rowSnippet, "%checked%", "checked=\"true\"");
    } else {
        rowSnippet = StringUtils.replace(rowSnippet, "%checked%", "");
    }

    rowSB.append(rowSnippet);

    return mappedValue;
}
 

private void SqlEscapeExample() {

        String userName = "1' or '1'='1";
        String password = "123456";
        String sql = "SELECT COUNT(userId) FROM t_user WHERE userName='"
                + userName + "' AND password ='" + password + "'";
        System.out.println(sql);
        userName = StringEscapeUtils.escapeSql(userName);
        password = StringEscapeUtils.escapeSql(password);
        String sql2 = "SELECT COUNT(userId) FROM t_user WHERE userName='"
                + userName + "' AND password ='" + password + "'";
        System.out.println(sql2);

    }
 

/**
*/
     @Override
     public final Object getValueAt(final int row, final int col) {
         final Note note = (Note) getObject(row).getValue();
         switch (col) {
         case 0:
             return StringEscapeUtils.escapeHtml(note.getNoteTitle()).toString();
         case 1:
             final Date lastUpdate = note.getLastModified();
             return lastUpdate;
             // return DateFormat.getDateTimeInstance(DateFormat.SHORT, DateFormat.SHORT, getTranslator().getLocale()).format(lastUpdate);
         default:
             return "error";
         }
     }
 

/**
 * Utility method for writing a (potentially large) String to a JspWriter,
 * escaping it for HTML display, without constructing another large String
 * of the whole content. 
 * @param s String to write
 * @param out destination JspWriter
 * @throws IOException
 */
public static void writeEscapedForHTML(String s, Writer w)
throws IOException {
    PrintWriter out = new PrintWriter(w);
    BufferedReader reader = new BufferedReader(new StringReader(s));
    String line;
    while((line=reader.readLine()) != null){
        out.println(StringEscapeUtils.escapeHtml(line));
    }
}
 

/**
 *
 * @param builder
 *            NOT null
 * @param content
 *            NOT null
 * @param parentStyle
 *            May be null
 */
private void handleTextContent(TextFXBuilder builder, HtmlContent content,
		StyleContainer parentStyle) {
	if (content.getTag() != null) {
		handleTextTag(builder, content.getTag(), parentStyle);
	} else {
		String unescapedText = StringEscapeUtils.unescapeHtml(
				content.getText().replaceAll("[\\t\\n\\x0B\\f\\r]", "")); //$NON-NLS-1$ //$NON-NLS-2$
		builder.addFormattedString(new FormattedString(
				parentStyle != null ? parentStyle
						: new TagStyleContainer(null, null),
				unescapedText));
	}
}
 

/**
 * Starting from the module <code>buttonsSB</code> object, 
 * creates all buttons for the jsp list. 
 * 
 * @throws JspException If any exception occurs.
 */

protected StringBuffer makeButton() throws JspException {

	StringBuffer htmlStream = new StringBuffer();
	SourceBean buttonsSB = (SourceBean)_layout.getAttribute("BUTTONS");
	List buttons = buttonsSB.getContainedSourceBeanAttributes();
	Iterator iter = buttons.listIterator();
	while(iter.hasNext()) {
		SourceBeanAttribute buttonSBA = (SourceBeanAttribute)iter.next();
		SourceBean buttonSB = (SourceBean)buttonSBA.getValue();
		List parameters = buttonSB.getAttributeAsList("PARAMETER");
		HashMap paramsMap = getParametersMap(parameters, null);
		String img = (String)buttonSB.getAttribute("image");
		String labelCode = (String)buttonSB.getAttribute("label");
		String label = msgBuilder.getMessage(labelCode, "messages", httpRequest);
		label = StringEscapeUtils.escapeHtml(label);
		htmlStream.append("<form action='"+urlBuilder.getUrl(httpRequest, new HashMap())+"' id='form"+label+"'  method='POST' >\n");
		htmlStream.append("	<td class=\"header-button-column-portlet-section\">\n");
		Set paramsKeys = paramsMap.keySet();
		Iterator iterpar = paramsKeys.iterator();
		while(iterpar.hasNext()) {
			String paramKey = (String)iterpar.next();
			String paramValue = (String)paramsMap.get(paramKey);
			while(paramValue.indexOf("%20") != -1) {
				paramValue = paramValue.replaceAll("%20", " ");
			}
			htmlStream.append("	  <input type='hidden' name='"+paramKey+"' value='"+paramValue+"' /> \n");
		}
		htmlStream.append("		<a href='javascript:document.getElementById(\"form"+label+"\").submit()'><img class=\"header-button-image-portlet-section\" title='" + label + "' alt='" + label + "' src='"+urlBuilder.getResourceLinkByTheme(httpRequest, img, currTheme)+"' /></a>\n");
		htmlStream.append("	</td>\n");
		htmlStream.append("</form>\n");
	}	
	return htmlStream;
}
 

public static String escapeString(String value) {
	if (StringHelper.isEmpty(value)) {
		return "";
	}

	return escapeComma(StringEscapeUtils.escapeJava(value));
}
 

private void printHeader(PrintWriter out, String nodeName) {
  out.print("<html><head>");
  out.printf("<title>%s Reconfiguration Utility</title>\n",
             StringEscapeUtils.escapeHtml(nodeName));
  out.print("</head><body>\n");
  out.printf("<h1>%s Reconfiguration Utility</h1>\n",
             StringEscapeUtils.escapeHtml(nodeName));
}
 

private static String unescape(String str) {
    int start = 0;
    int end = str.length();
    if (str.startsWith("\"")) {
        start = start + 1;
    }
    if (str.endsWith("\"")) {
        end = end - 1;
    }
    str = str.substring(start, end);
    return StringEscapeUtils.unescapeJava(str);
}
 

/**
 * persist the updates
 */
private void doUpdateContext(final UserRequest ureq) {
    // refresh group to prevent stale object exception and context proxy issues
    final BGContextDao contextManager = BGContextDaoImpl.getInstance();
    this.groupContext = contextManager.loadBGContext(this.groupContext);
    // update defaultContext switch changes
    if (ureq.getUserSession().getRoles().isOLATAdmin()) {
        final boolean newisDefaultContext = this.contextController.isDefaultContext();
        if (newisDefaultContext) {
            if (this.repoTableModelEntries.size() == 0) {
                showError("form.error.defaultButNoResource");
                this.contextController.setValues(this.groupContext);
                return;
            }
        }
        this.groupContext.setDefaultContext(newisDefaultContext);
    }
    // update name and descripton
    final String name = this.contextController.getName();
    final String desc = this.contextController.getDescription();
    this.groupContext.setName(name);
    this.groupContext.setDescription(desc);
    contextManager.updateBGContext(this.groupContext);
    // update velocity
    final String title = DefaultContextTranslationHelper.translateIfDefaultContextName(this.groupContext, getTranslator());
    this.editVC.contextPut("title", getTranslator().translate("edit.title", new String[] { "<i>" + StringEscapeUtils.escapeHtml(title) + "</i>" }));
}
 

/**
 * {@inheritDoc}
 */
@Override
public String getHistoryDetails(Server server, User currentUser) {
    LocalizationService ls = LocalizationService.getInstance();
    StringBuilder retval = new StringBuilder();
    retval.append("</br>");
    retval.append(ls.getMessage("system.event.scapPath"));
    retval.append(StringEscapeUtils.escapeHtml(scapActionDetails.getPath()));
    retval.append("</br>");
    retval.append(ls.getMessage("system.event.scapParams"));
    retval.append(scapActionDetails.getParameters() == null ? "" :
        StringEscapeUtils.escapeHtml(scapActionDetails.getParametersContents()));
    if (this.getSuccessfulCount() > 0) {
        SelectMode m = ModeFactory.getMode("scap_queries", "lookup_xccdftestresult_id");
        Map<String, Object> params = new HashMap<String, Object>();
        params.put("action_scap_id", scapActionDetails.getId());
        params.put("server_id", server.getId());
        DataResult<Map<String, Long>> dr = m.execute(params);
        Long xccdfDetailId = dr.get(0).get("id");
        retval.append("</br>");
        retval.append("<a href=\"/rhn/systems/details/audit/XccdfDetails.do?sid=" +
                server.getId() + "&xid=" + xccdfDetailId + "\">");
        retval.append(ls.getMessage("system.event.scapDownload"));
        retval.append("</a>");
    }
    return retval.toString();
}
 

/**
    * Shows Teams page
    */
   @RequestMapping("/burningQuestions")
   public String burningQuestions(HttpServletRequest request) throws IOException, ServletException {

long toolContentId = WebUtil.readLongParam(request, AttributeNames.PARAM_TOOL_CONTENT_ID);
Scratchie scratchie = scratchieService.getScratchieByContentId(toolContentId);

//find available burningQuestionDtos, if any
if (scratchie.isBurningQuestionsEnabled()) {
    List<BurningQuestionItemDTO> burningQuestionItemDtos = scratchieService.getBurningQuestionDtos(scratchie,
	    null, true, true);

    //unescape previously escaped session names
    for (BurningQuestionItemDTO burningQuestionItemDto : burningQuestionItemDtos) {
	List<BurningQuestionDTO> burningQuestionDtos = burningQuestionItemDto.getBurningQuestionDtos();

	for (BurningQuestionDTO burningQuestionDto : burningQuestionItemDto.getBurningQuestionDtos()) {

	    String escapedBurningQuestion = StringEscapeUtils
		    .unescapeJavaScript(burningQuestionDto.getEscapedBurningQuestion());
	    burningQuestionDto.setEscapedBurningQuestion(escapedBurningQuestion);

	    String sessionName = StringEscapeUtils.unescapeJavaScript(burningQuestionDto.getSessionName());
	    burningQuestionDto.setSessionName(sessionName);
	}

	Collections.sort(burningQuestionDtos, new Comparator<BurningQuestionDTO>() {
	    @Override
	    public int compare(BurningQuestionDTO o1, BurningQuestionDTO o2) {
		return new AlphanumComparator().compare(o1.getSessionName(), o2.getSessionName());
	    }
	});
    }

    request.setAttribute(ScratchieConstants.ATTR_BURNING_QUESTION_ITEM_DTOS, burningQuestionItemDtos);
}

return "pages/tblmonitoring/burningQuestions";
   }