classtest/Reflect_XSS/Reflect_XSS_good.jsp

<%@ page language="java" contentType="text/html; charset=ISO-8859-1" import="java.util.regex.*" 
    pageEncoding="ISO-8859-1"%>
<%
String action = request.getParameter("action");
String field1 = "field1";
String regex1 = "^[0-9]{3}$";// any three digits
Pattern pattern1 = Pattern.compile(regex1);

if("Purchase".equals(action))
{
	if(!pattern1.matcher(field1).matches())
	{
	
		/** If they supplied the right attack, pass them **/
		out.write("alert('Whoops: You entered an incorrect access code of \"" + field1 + "\"');");  // good  xss
	
	}
	
}
%>