Java 表单提交后如何显示参数（将字符转换为HTML实体名称）

我试图通过编码HTML响应来编写脚本，以防止跨站点脚本攻击。但是我不知道如何在表单提交之前转换字符

html

---

编码html响应不是防止CSRF攻击的正确方法。如果不想编写CSRF保护，请使用。这是一个筛选器，可以与jsp项目集成。另一个选项是您可以自己手动控制CSRF。请检查此选项

<%
    String mobile       = common.setNullToString(request.getParameter("mobile"));
    String converted_param= detect_xss.escapeHtml(mobile); //convert method
%>

<form name="mainform" action="test2.jsp">
<input type="text" name="name" value="" >
<input type="button" onclick="button();">
</form>

public class detect_xss {
    public static final HashMap m = new HashMap();
    static{
     m.put(34, "&quot;"); // < - less-than
     m.put(60, "&lt;"); // < - less-than
     m.put(62, "&gt;"); // > - greater-thanof entities and integer value of a char
    }

     public static String escapeHtml(String html) 
     {
         String str = html;
         try 
         {
             StringWriter writer = new StringWriter((int)(str.length() * 1.5));
             escape(writer, str);
             return writer.toString();
         }
         catch (IOException ioe) 
         {
             ioe.printStackTrace();
             return null;
         }
    }

     public static void escape(Writer writer, String str) throws IOException 
     {
         int len = str.length();
         for (int i = 0; i < len; i++) 
         {
             char c = str.charAt(i);
             int ascii = (int) c;
             String entityName = (String) m.get(ascii);
             if (entityName == null) 
             {
                 if (c > 0x7F) 
                 {
                    writer.write("&#");
                    writer.write(Integer.toString(c, 10));
                    writer.write(';');
                 }
                 else {
                     writer.write(c);
                 }
             } else {
                 writer.write(entityName);
             }
         }
     }

}

http://localhost:9080/home/test2.jsp?mobile=<script>alert%28"test"%29<%2Fscript>

http://localhost:9080/amgeneral/test2.jsp?mobile=<script>alert("test")</script>