How to avoid apps from XSS attacks?

Question

How to safe guard our web applications from XSS attacks? One app is vulnearable to attack, if it does not do any conversion of a special charecters.

Answer 1

Just to add to WhiteFang34' list:

• JSoup whitelist sanitizer

It has several whitelists built-in to choose from, such as allowing some HTML, no HTML, etc.

I chose this over Apache Commons's StringEscapeUtils.escapeHtml() because of how it handles apostrophes. I.e. if our users type in:

Alan's mom had a good brownie recipe.

JSoup will leave the apostrophe alone, whereas Apache Commons would escape that string as:

Alan\'s mom had a good brownie recipe.

Which I wouldn't want to have to worry about unescaping before displaying to the user.