In my legacy project i can see the usage of escapeHtml before string is sent to browser.
StringEscapeUtils.escapeHtml(stringBody);
I know from
you have to escape html or xml when there is a possibility that it might get interpreted along with the page-generated html (read jsp).
this good question also explains it.