currently I use org.apache.commons.lang.StringEscapeUtils escapeHtml() to escape unwanted HTML tags in my Strings but then I realized it escapes characters with
org.apache.commons.lang.StringEscapeUtils escapeHtml()
This looks very good to me:
org/apache/commons/lang3/StringEscapeUtils.html#escapeXml(java.lang.String)
By asking XML, you will get XHTML, which is good HTML.