Cross-Site Scripting: Reflected xss vulnerability with response.getWriter().write

Question

JAVA CODE

response.setContentType("application/xml");
response.setHeader("Cache-Control", "no-cache");