The <tc:out/>
display an outputtext combined with a label.
To put a label in front of a outputtext, use the label
attribute.
<tc:out label="Output" value="Some Text"/>
If the given string to the outputfield is HTML/XML code, it will be escaped by default.
But you can turn it off with the escape
attribute.
<tc:out label="Escape on (default)" escape="true" value="\#{outController.html}"/>
Although the HTML code is not escaped, you can see, that the text is not colored. This is, because the code is sanitzed (see next section).
<tc:out label="Escape off" escape="false" value="\#{outController.html}"/>
Sanitize remove HTML/XML-Tags from a given string if not escaped. It can be configured in the tobago-config.xml.
If you want to write your own sanitizer, you have to implement
org.apache.myfaces.tobago.sanitizer.Sanitizer
.
Sanitzing can be deactivated for a component using the sanitize
attribute.
But be careful, because of XSS vulnerability.
<tc:out label="Sanitize off" escape="false" sanitize="never" value="\#{outController.html}"/>