html injection

[wenzhoou]

in /spring-mvc-showcase/src/main/webapp/WEB-INF/views/form.jsp
u forget to write a c:out tag in <div id="message" class="success">${message}</div>
so if u input a name like "Test<script>alert('abc')</script>", and click submit button, you will see what i mean