Two points which need to pay attention when applying: (1) Use single quote for parameter in Javascript function e.g. foo is a Javascript fcuntion; value is a JSP variable. onclick="foo(' <%=value %>');" (2) Use following Javascript function to encode String containing special characters (e.g. ";" "\r") You have 3 options: escape() will not encode: @*/+ encodeURI() will not encode: ~!@#$&*()=:/,;?+' encodeURIComponent() will not encode: ~!*()' References: http://stackoverflow.com/questions/332872/how-to-encode-a-url-in-javascript http://stackoverflow.com/questions/10033555/pass-a-jsp-variable-as-parameter-to-javascript-function http://stackoverflow.com/questions/4803906/jsp-variable-accssing-in-javascript