Escaping html in Java

Question

How do I make sure I don\'t escape something twice?

I\'ve heard that its good practice to escape values as you receive them from a form, and also escape when you output.

Answer 1

You should only html encode when you output something to a browser. This prevents XSS attacks. The kind of escaping that you do when you collect data from a form, before you insert it into a database is not html encoding. It's escaping special database characters (best done using parameterized queries). The purpose of that is to prevent SQL injection attacks. So there is no double encoding going on.