I was executing my code in HPE Fortify, and I keep getting XSS errors when I use java code inside scriptlets in a java script. So I have used jstl tags c:out to resolve the problem. However it is still throwing medium level errors for XSS poor validation in all the places wherever I have used c:out After some research on OWASP, in place of c:out I have started using var url1 = "<%= Encode.forJavaScript(URLString) %>"; and imported <%@page import="org.owasp.encoder.Encode"%> Even with this I am getting XSS shared link error. I am not sure what else to do.

var url1 = "<c:out value="${URLString}"></c:out>" var url1 = "<%= Encode.forJavaScript(URLString) %>"; both are throwing same XSS message. Any ideas ??