QA-5984

Avoid concatenating string with + in JSPs
Avoid attribute injection