O' RE I LLY~
`
`Hans Bea~gsten
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`001
`
`

`
`Other JavaTM resources from O'Reilly
`
`Relafied titles
`
`Enterprise JavaBeans'"'
`Java'"' ~ XML
`Java"" Cookbook
`Java'' Enterprise in a Nutshell
`Java'" I/O
`Java"' in a Nutshell
`Java'" Perforn~ance Tuning
`
`Java'M Programming with
`Oracle SQLJ
`Java'"' Security
`J~vaServer Pages'"'
`Java"" Swing
`Learning Java`"
`
`Java Books java.oreilly.com is a complete catalog of O'Reilly's books on
`Resource Center Java and related technologies, including sample chapters and
`code examples.
`
`+~ o°REILLY'
`~'
`~~~rJava.~~~.
`
`The Independent Source for Enterprise Java
`
`OnJava.com is a one-stop resource for enterprise Java develop-
`p
`~
`ers featurin news code reci es, interviews weblo s and
`more.
`
`Conferences O'Reilly &Associates brings diverse innovators together to nur-
`ture the ideas that spark revolutionary industries. We specialize
`in documenting the latest tools and systems, translating the in-
`novator's knowledge into useful skills for those in the trenches.
`Visit conferences.oreilly.com for our upcoming events.
`
`f~~ .
`
`Safari Bookshelf (safari.oreilly.com) is the premier online refer-
`o~REILLYNETY!'ORK
`.>~a~ ~m ence library for programmers and IT professionals. Conduct
`-h-'a'!~~- searches across more than 1,000 books. Subscribers can zero in
`on answers to time-critical questions in a matter of seconds.
`Read the books on your ~3oolcshelf from cover to cover or sim-
`ply flip to the page you need. Try it today with a free trial.
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`002
`
`

`
`THIRD EDITION
`
`esTM
`
`.1avaServ~r Pa
`g
`
`Hans Bergsten
`
`O~REILLY~
`Beijing •Cambridge •Farnham Koln •Paris •Sebastopol •Taipei •Tokyo
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`003
`
`

`
`JavaServer Pages'"", Third Edition
`by Hans I3etgsten
`Copyright O' 2004, 2002, 2001 O'Reilly Media, Inc. All rights reserved.
`Printed in the United States of America.
`Published by O'Reilly Media, Inc., 1005 Gravenstein Highway North, Sebastopol, CA 95472.
`O'Reilly Media, Inc. books may be purchased for educational, business, or sales promotional use. On-
`line editions are also available for most titles (safari.oreilly.com). Eormore information, contact our cor-
`porate/institutional sales department: (800) 998-9938 or corpo7-c~te@oreilly.com.
`
`Editor:
`Production Editor:
`Cover Designer:
`Interior Designer:
`
`Printing History:
`
`Brett McLaughlin
`Sarah Sherman
`Para Spremulli
`David rutato
`
`January 2001:
`
`First Edition.
`
`August 2002:
`
`Second Edition.
`
`December 2003:
`
`Third Edition.
`
`Nutshell Handbook, the Nutshell Handbook logo, and the O'Reilly logo are registered trademarks of
`O'Reilly Media, Inc. The Java Series, Java Server Pages, Third Edition, the image of a grey wolf, and
`related trade dress are trademarks of O'Reilly Media, Inc. Java'rM and all Java-based trademarks and
`logos are trademarks or registered trademarks of Sun Microsystems, Inc., in the United States and other
`countries. O'Reilly Media, Inc., is independent of Sun Microsystems. Openwave, the Openwave logo,
`'and UP.SDK are trademarks of Openwave Systems Inc. All rights reserved.
`Many of the designations used by manufacturers and sellers to distinguish their products are claimed as
`trademarks. Where those designations appear in this book, and O'Reilly Media, Inc. was aware of a
`trademark claim, the designations have been printed in caps or initial caps.
`While every precaution has been taken in the preparation of this hook, the publisher and author assume
`no responsibility for errors or omissions, or for damages resulting from the use of the information
`contained herein.
`
`_~ This book uses RepKover"; a durable and flexible lay-flat binding.
`RepKoveru
`
`ISBN-10: U-596-00563-h
`ISBN- l3: 978-0-596-00563-4
`CM)
`
`[02/07]
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`004
`
`

`
`CHAPT
`Introducing .1avaServer Pa
`
`The Java 2 Enterprise Edition (J2E~) has taken the once-chaotic task of building an
`Internet presence and transformed it to the point where developers can use Java to
`efficiently create multitier., server-side applications. Today, the Java Enterprise APIs
`have expanded to encompass a number of areas: RMI and CORBA £or remote object
`handling, JDBC for database interaction, JNDI for accessing naming and directory
`services, Enterprise JavaBeans for creating reusable business components, Java Mes-
`saging Service (JMS) for message-oriented. middleware, JAXP for XML processing,
`JAXR, JAX-RPC and SAAJ for web services, Java Transaction API (JTA) for perform-
`ing atomic transactions, and much more. In addition, J2EI~ also supports servlets, an
`extremely popular. Java substitute for CGI scripts. The combination of these technolo-
`gies allows programmers to create distributed business solutions for a variety of tasks.
`In late 1.999, Sun Microsystems added a new element to the collection of Enterprise
`Java tools: JavaServer Pages (JSP). JavaServer Pages are built on top of Java servlets
`and designed to increase the efficiency in which programmers, and even nonpro-
`grammers, can create web content. This book is primarily about JavaServer Pages, cov-
`ering the latest version of this technology, JSP 2.0, as well as the related JSP Standard
`Tag Library (JSTL) Version 1.1. It also covers other J2EE technologies, such as serv-
`lets and JDBC, with focus on how to combine them with JSP in the most efficient way.
`
`What IsJavaServer Pages?
`Put succinctly, JavaServer Pages is a technology for developing web pages that
`include dynamic content. Unlike a plain HTML page, which contains static content
`that always remains the same, a JSP page can change its content based on any num-
`ber of variable items, including the identity of the user, the user's browser type,
`information provided by the user, and selections made by the user. As you'll see later
`in the book, this functionality is key to web applications such as online shopping and
`employee directories, as well as for personalized and internationalized content.
`
`3
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`005
`
`

`
`A JSl? page contains standard markup language elements, such as HTML tags, just
`like a regular web page. However, a JSP page also contains special JSP elements that
`allow the server to insert dynamic content in the page. JSP elements can be used for a
`variety of purposes, such as retrieving information from a database or registering user
`preferences. When a user asks for a JSP page, the server executes the JSP elements,
`nter~;es the results with the static parts of the page, and sends the dynamically com-
`posed page back to the browser, as illustrated in Figure 1-l.
`
``
`
`-.
`
`~<html>
`Use as is
`<html>
`<body> ~~' <body>
`<jsp: useBean... /y
`Execute
`<jsp:getProperty.../>
`<jsp:getProperty.../>
`</body>
`</html>
`
`Use as is
`
`Dynamic Content
`
`</body>
`</html>
`
`Figure 1-1. Generating dynamic content,with JSP elements
`JSP defines a number of standard elements that are useful for any web ap~~lication,
`such as accessing JavaBeans components, passing control between pages and shar-
`ing information between requests, pages, and users. Developers can also extend the
`JSP syntax by implementing application-specific elements that perform tasks such as
`accessing databases and Enterprise JavaBeans, sending email, and generating H"I'ML
`to present application-specific data. One such set of commonly needed custom ele-
`ments is defined by a specification related to the JSP specification: the JSP Standard
`Tag Library (JSTL) specification. "I'he combination of standard elements and custom
`elemezzts allows for the creation of powerful web applications.
`
`Why Use)SP?
`In the early days of the Web, the Common Gateway Interface (CGI) was the only
`tool for developing dynamic web content. However, CGI is not an efficient solution.
`For every request that comes in, the web server has to create a new operating-system
`process, load an interpreter and a script, execute the script, and then tear it all down
`again. This is very taxing for the server and doesn't scale well when the amount of
`traffic increases.
`Numerous CGI alternatives and enhancements, such as FastCGl, mod_perl from
`Apache, NSAPI from Netscape, ISAPI from Microsoft, and Java servlets from Sun
`Microsystems, have been created over the years. While these sol~itions offer better
`performance and scalability, all these technologies suffer from a common problem:
`they generate web pages by embedding H"I'ML directly in programming language
`code. This pushes the creation of dynamic web pages exclusively into the realm of
`programmers. JavaServer Pages, however, changes all that.
`
`4 ~
`
`Chapter 1: Introducing JavaServer Pages
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`006
`
`

`
`Embedding Dynamic Elements in HTML Pages
`JSI' tackles the problem from the other direction. Instead of embedding HTML in
`programming code, JSP lets you embed special active elements into HT.ML pages.
`These elements look similar to HZ'ML elements, but behind the scenes they are actu-
`al.ly componentized Java programs that the server executes when a user requests the
`page. Here's a simple JSP page that illustrates this:
`<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" ~>
`<html>
`<body becolor="white">
`
`<jsp:useBean id="clock" class="java.util.Date" />
`<c:choose>
`<c:when test="${clock.hours < 12}">
`<h1>Good morning!</h1>
`</c:when>
`<c:when test="${clock.hours < 18}">
`<h1>Good day!</h1>
`</c:when>
`<c:otherwise>
`<h v Good evening!</hv
`</c:otherwise>
`</c:choose>
`Welcome to our site, open 24 hours a day.
`</body>
`</html>
`This page inserts a different message to the user based on the time of day: "Good
`morning!" if. the local time is before 12 P.M., "Good day!" if between 12 P.M. and
`6 P. M., and "Good evening!" otherwise. When a user asks for this page, the JSP-
`eiiabled web server executes the logic represented by the highlighted JSP elements
`and creates an HTML page that is sent back to the user's browser. For example, if
`the current time is 8:53 P.M., the resulting page sent from the server to the browser
`looks like this:
`
`<html>
`<body becolor="white">
`<h1>Good evening!</h1>
`Welcome to our site, open 24 hours a day.
`</body>
`</html>
`A screen shot of this result is shown in Figure 1.-2.
`In addition to the HTML-like JSP elements, a JSP page can also contain Java code
`embedded in so-called scripting elements. This feature has been part of the JSP speci-
`fication from the very first version, and it used to be convenient for simple condi-
`tionallogic. With the introduction of the JSl' Expression Language (EL) and the JSP
`Standard Tag Library (JS"I'L), however, Java code in a page is rarely needed. In addi-
`tion, embedding ton much code in a web page is no better than using HTML
`
`Why Use 1SP? ~ 5
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`007
`
`

`
`_._
`~
`;~~
`T
`-
`_,
`FJ., Fd0 S/le~v _^~p,:.h Gc ~'~sd n~n~k~ Tssf~: ~ i_Ic. Q°hens C 4 ~ ..
`
`— — --
`_....-. ~~. _..,. `~'~
`
`—
`
`_.
`
`~
`
`y
`_
`
`'.J
`
`JL ~~_._
`
`f
`
`~
`
`..~ii-.
`
`Goad e~eningl
`Welcome to our site, open 24 hotus a day.
`
`r._
`
`_~q} xi
`—
`
`~
`
`1
`
`,~i,(J eJ~iur~a! :s`~SRmnUGd~ic~
`
`Figure 1-2. The output of a simple JSP page
`elements in a server-side program, and often leads to a web application that is hard
`to maintain and debug. "1 he examples in this book rarely use scripting elements, but
`thEy are described in detail in Chapter 16.
`
`C~pilation
`Another benefit that is important to mention is that a JSP page is always compiled
`before it's processed by the server. Remember that older technologies such as CGI/
`Perl require the server to load an interpreter and the target script each time the page
`is requested. JSP gets around this problem by compiling each JSP page into execut-
`able code the first time it's requested (or on demand), and invoking the resulting
`code directly on all subsequent requests. When coupled with a persistent Java vir-
`tual machine on a JSP-enabled web server, this allows the server to handle JSP pages
`much faster.
`
`Using the Right Person fior Each Task
`As I alluded to earlier, JSP allows you to separate the markup language code, such as
`HTML, from the programming language code used to process user input, access
`databases, and perform other application tasks. One way this separation takes place
`is through the use of the JSP standard and custom elements; these elements are
`implemented with programming code and used the same way as page markup ele-
`ments in regular web pages.
`Another way to separate is to combine JSP with other J2EE technologies. For exam-
`ple, Java servlets can handle input processing, Enterprise JavaBeans (EJB) can take
`care of the application logic, and JSP pages can provide the user interface.
`This separation means that with JSP, a typical business can divide its efforts among
`two groups that excel in their own areas of expertise: a Java web development team
`with programmers who implement the application logic as servlets, EJBs and cus-
`tom JSP elements, end page authors who craft the specifics of the interface and use
`the powerful custom elements without having to do any programming. We'll tallz
`
`6 ~
`
`Chapter 1: Introducing 1avaServer Pages
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`008
`
`

`
`more about this belzefit as we move through the book, although I should reitE:rate
`that the first half. of the book is devoted more to those without programmin€; e~pel•i--
`ence, while the second half. is for programmers who wish to combine JSP with other
`technologies and create their own JSP elements.
`
`Integration with Enterprise Java APIs
`Finally, because JavaServer Pages are built nn top of the Java Servlets API, JSP has
`access to all the powerful Enterprise Java APIs, including:
`
`• JDBC
`• Remote Method Invocation (KMI) and OMG CORBA sL~pport
`• JNDI (Java Naming and Directory Interface)
`• enterprise Javal3eans (EJB)
`• JMS (Java Message Service)
`• JTA (Java Transaction API)
`JAXP (Java API for XML Processing)
`• JAXR (Java API for XML Registries), JAX-RPC (Java API for XMI_-based RPC),
`and SAAJ (SOAP with Attachments API for Java)
`• JavaMail
`This means that you can easily integrate Jav~Server Pages with your existing Java
`Enterprise solutions.
`
`Other Solutions
`At this point, let's digress and look at some other solutions for dynamic web con-
`tent. Some of these solutions are similar to JSP, while others are descendants of older
`technologies. Many don't have the uninue combination of features and portability
`offered by JavaServer Pages.
`
`Active Server Pages (ASP)
`Microsoft's Active Server Pages (ASP) is a popular technology for developing
`dynamic web sites. Just like JSP, ASP lets a page author include logic, such as
`VBScript and JScript code, in regular web pages to generate the dynamic parts. For
`complex code, COM (ActiveX) components written in a programming language such
`as C++ can be invoked by the scripting code. The standard distribution includes
`components for database access and more, and other components are available from
`third parties. When an ASP page is requested, the code in the page is executed by the
`server. The result is inserted into the page, and the combination of the static and
`dynamic content is sent to the browser.
`
`Why Use JSP? ~ 7
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`009
`
`

`
`ASP.NET, the latest version of ASI', adds a number of new features. As an alterna-
`tive to scripting, dynamic content can be generated by HTML/XIVIL-like elements
`similar to JSP action elements. For improved performance, ASP.NET pages are com-
`piled as opposed to interpreted, and Common Language Runtime (CLR) languages,
`such as C#, JScript.NET, and Visual Basic.NET, are used instead of the scripting
`languages supported in previous ASP versions.
`Due to ASP's reliance on native COM code as its component me>del, it's primarily a
`solution for the Windows platform. Limited support for other platforms, such as the
`Apache web server on Unix, is available through third-party products such as Sun
`Chili!Soft ASP (Sun Microsystems, Inc.) and InstantASP (I~alcyon Software). ASPNET
`is a part of the complete .NET platform, with the potential for. better support on non-
`tiiVinc~ows platforms. You can read more about ASl' and ASP.NET on Microsoft's web
`sire, http://www.microsoft.com/.
`
`SNP
`PHP' is an open source web scripting language. Like JSP and ASP, PHP allows a page
`author to include scripting code in regular web pages to generate dynamic content.
`PHP has a C-like syntax with some features borrowed from Perl, L++, and Java.
`Complex code can be encapsulated in both functions and classes. A large number of
`predefined functions are available as part of 1'HP, such as accessing databases, LDAP
`directories, and mail servers, creating PDF documents and images, and encrypting
`and decrypting data. PHP 4, the current version, compiles a page when it's
`requested, executes it, and merges the result of executing the scripts with the static
`text in the page, before it's returned to the browser.
`PHP is supported nn a wide range of platforms, including all major web servers on
`operating systems like Windows, Mac, and most Unix flavors, and with interflces to
`a large number of database engines. More information about PHP is available at
`http:/lwww. php. net/.
`
`ColdFusion
`Macromedia's ColdFusion product is another popular alternative for generating
`dynamic web content. The dynamic parts of a page are generated by inserting
`HTMI._/XML-like elements, known as the ColdFusion Markup Language (CFML),
`into web pages. CFML includes a large set of elements for tasks such as accessing
`databases, files, mail servers, and other web servers, as well as conditional process-
`ing elements such. as loops. The latest version of ColdFusion also includes elements
`for communication with Java servlets and Enterprise JavaBeans. Custom elements
`can be developed in C++ or Java to encapsulate application-specific functions, and
`
`The precursor to PHP was a tool called Personal Home Page. Today PHP is not an acronym for anything; it's
`simply the name Ior this product.
`
`8 ~
`
`Chapter 1: Introducing 1avaServer Pages
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`010
`
`

`
`CFML extensions are available from third parties. ColdFusic~n didn't initially sup-
`port scriptizzg languages, but since ColdFusion 4.5, JavaScript-like code can ~-,e.
`embedded in the web pages in addition to the CFML tags.
`The ColdFusion MX, I.nterprise edition, is supported on Windows, Solaris, HP/~)X
`and Linux, for all major web servers and databases. A special J2EE version of C:c~ld-
`Fusion MX extends the ColdFusion features to a number of J2EE application servers.
`For more information, visit Macromedia's web site at http://www.macromedia.coml.
`
`Java servlet template engines
`A Java servlet template engine is another technology for separating presentation from
`processing. When servlets became popular, it didn't take long before developers real-
`ized how hard it was to maintain the presentation part when the HTML code was
`embedded directly in the servlet's Java code. As a result, a number of. so-called tem-
`plate engines have been developed as open source products to help get HTML nut of
`the servlets.
`Template engines are intended to be used with pure code components (servlets) and
`to use web pages with scripting code only for the presentation part. Requests are sent
`to a servlet that processes the request, creates objects that represent the result, and
`calls on a web page template to generate the HTML to be sent to the browser. "I he
`template contains scripting code similar to the alternatives described earlier. The
`scripting languages used by these engines are less powerful, however, since scripting
`is intended only for reading data objects and generating HTML code to display their
`values. All the other products and technologies support general-purpose languages,
`which can (for better or for worse) be used to include business logic in the pages.
`Two popular template engines are Velocity (http://jakarta.apache.org/velocityn and
`FreeMarlcer (http://freemarker.org~.
`
`The JSP Advantage
`JSP combines the most important features found in the alternatives:
`• JSP supports both. scripting- and element-blsed dynamic content, and allows
`developers to create custom tag libraries to satisfy application-specific needs.
`• JSP pages are compiled for efficient server processing.
`• JSP pages can be used in combination with servlets that handle the busizless
`logic, the model favored by Java servlet template engines.
`In addition, JSP has a couple of unique advantages that make it stand out from the
`crowd:
`• JSP is a specification, not a product. This means vendors can compete with dif-
`ferent implementations, leading to better performance and duality. It also leads
`to a less obvious advantage, namely that when so many companies have invested
`
`Why Use 15P? ~ 9
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`011
`
`

`
`time and money in the technology, chances are it will be around for a long time,
`with reasonable assurances that new versions will be backward compatible; with
`a proprietary technology, this is not always a given.
`• JSP is an integral part of J2EE, a complete platform for enterprise class applica-
`tions. Phis means that JSP can plly a pert in the simplest applications to the
`most complex and demanding.
`
`You Need to Get Started
`Before we begin, let's quickly run through what you need to run the examples and
`develo}~ your own applications. You really only need three things:
`• A PC or workstation, with a connection to the Internet so you can download the
`software you need
`• A Java 2 compatible-Java Software Development Kit (Java 2 SDK)
`• A JSP 2.0-enabled web server, such as Apache Tomcat from the Jakarta Project
`The Apache "Tomcat server is the reference implementation for JSP. All the examples
`in the book were tested on Tomcat. In Chapter 4, I'll show you how to download,
`install, and configure the Tomcat server as well as the examples described in this
`book.
`In addition, there are a variety of other tools and servers that support JSP, from both
`open source projects and commercial companies. Close to 30 different server products
`support JSP to date, and roughly 10 IDES and authoring tools with varying degrees of
`JSP support are listed on Sun's JSI' web site (http://java.sun.com/products/jsp~. You
`may want to evaluate some of these products when you're ready to start developing
`your application, but all you really need to work with the exannples in this book is a
`regular text editor, such as Notepad, vi, or Emacs, and of course the Tomcat server.
`So let's get going and take a closer look at what JSP has to offer. You'll need a solid
`ground to stand nn though, so in the next chapter we will start with the foundations
`on which JSP is built: HTTP and Java servlets.
`
`10 ~
`
`Chapter 1: Introducing Java Server Pages
`
`WhatsApp/Facebook Ex. 1022
`IPR2015-00740
`
`012