You should use single quotes on the value
parameter, ie:
value="<%=request.getParameter("userName")%>"
or set the org.apache.jasper.compiler.Parser.STRICT_QUOTE_ESCAPING
parameter to false
as described here:
http://blogs.sourceallies.com/2009/10/strict-quote-escaping-in-tomcat/