## 6.2.1.4 Expressions

In GSP the `<%= %>` syntax introduced earlier is rarely used due to the support for GSP expressions. It is present mainly to allow ASP and JSP developers to feel at home using GSP. A GSP expression is similar to a JSP EL expression or a Groovy GString and takes the form `${expr}`:

    <html>
      <body>
        Hello ${params.name}
      </body>
    </html>

However, unlike JSP EL you can have any Groovy expression within the `${..}` parenthesis. Variables within the `${..}` are not escaped by default, so any HTML in the variable's string is output directly to the page. To reduce the risk of Cross-site-scripting (XSS) attacks, you can enable automatic HTML escaping via the `grails.views.default.codec` setting in `grails-app/conf/Config.groovy`:

    grails.views.default.codec='html'

Other possible values are 'none' (for no default encoding) and 'base64'.