Is application developed by servlet more secure than jsp?

No. Basically JSPs are servlets. The JSP compiler takes the JSP page and compiles it as Java servlet, nothing more, nothing less. In my opinion you cannot say that one is more secure than the other.

The reason why people still use servlets is perhaps that some (including me, sorry) came to the conclusion that JSPs are ****, because they still mix logic and presentation even if you make excessive use of tag libraries (what leeds you to a massive performace loss due to the often used introspection calls).

ProhaskaA at 2007-6-29 11:22:57 >

Servlets are no more secure than JSPs, because JSPs are servlets - they're just another way of building the same thing. There is nothing you can do in a JSP that you can't do in a servlet or vice versa.

Why switch to or from JSPs or servlets? - you should be using both. Use servlets for heavy processing logic and JSPs for presentation (MVC pattern). That way you get maximum separation of logic and presentation. You can pretty much let HTML developers work normally, then come along afterwards and stick a little bit of Java code in the page to make it all dynamic. Better still, you can create easy-to-use custom tags that your HTML developers can easily understand without needing any programming experience. This leaves you free to work on the logic in the back-end.

mattbunch at 2007-6-29 11:22:57 >