Two points which need to pay attention when applying:   (1)  Use single quote for parameter in Javascript function   e.g.  foo is a Javascript fcuntion; value is a JSP variable.  onclick="foo(' <%=value %>');"   (2)  Use  following Javascript function to encode String containing   special characters (e.g. ";"  "\r")   You have 3 options:     escape()  will not encode:  @*/+    encodeURI()  will not encode:  ~!@#$&*()=:/,;?+'   encodeURIComponent()  will not encode:  ~!*()'        References:     http://stackoverflow.com/questions/332872/how-to-encode-a-url-in-javascript    http://stackoverflow.com/questions/10033555/pass-a-jsp-variable-as-parameter-to-javascript-function    http://stackoverflow.com/questions/4803906/jsp-variable-accssing-in-javascript