[Java] XSS – Java Secure Coding Using Security Encoding Library

Using Security Encoding Library

1. Download ESAPI.jar from the ESAPI Project page, and add it to library of the project.
2. Import the package in jsp page: <%@ page language=”java” import=”org.owasp.esapi.*” %>
3. Add code according to the different cases:

Case #1

HTML escape before inserting untrusted data into HTML element content.

1 2 3 4

<% String safe = ESAPI.encoder().encodeForHTML( request.getParameter( "input" ) ); %> <%= safe %>

Case #2

Attribute escape before inserting untrusted data into HTML common attributes.

1 2 3 4

<% String safe = ESAPI.encoder().encodeForHTMLAttribute( request.getParameter( "input" ) ); %> '<%= safe %>'>

Case #3

JavaScript escape before inserting untrusted data into JavaScript data values.

1 2 3 4 5

<% String safe = ESAPI.encoder().encodeForJavaScript( request.getParameter( "input" ) ); %> '<%= safe %>')”>

Case #4
URL escape before inserting untrusted data into HTML URL parameter values.

1 2 3 4

<% String safe = ESAPI.encoder().encodeForURL( request.getParameter( "input" ) ); %> 'http://www.victim-site.com?test=<%= safe %>'>link

References 
http://owasp-esapi-java.googlecode.com/svn/trunk_doc/latest/org/owasp/es…
http://code.google.com/p/owasp-esapi-java/downloads/list