HTML-Entity escaping to prevent XSS

Question

I have some user input. Within my code, I ensure that the following symbols are escaped:

& -> & 
< -> < 
> -> >
<         


        

Answer 1

I recommend you to use Appache Common Lang library to escape strings, for exmaple to escape HTML:

String escapedString = org.apache.commons.lang.StringEscapeUtils.escapeHtml(String str);

the library has many useful methods to escape in HTML, XML, Javascript.