The <s:property>
tag has an escapeHtml
attribute which is true
by default.
(Hopefully for obvious reasons.)
<c:out>
is part of the JSTL, and you use it in S2 like in any other web app, with the caveat that it's because of an S2 request wrapper you can use JSP EL to access the value stack.