XSS Protection from Query Strings in Java
In addition to RotoRa's answer:

Instead of

    String[] pair = param.split("=");


you should call

    String[] pair = param.split("=", 2);


Otherwise you will trim base64-encoded data, which may happen in some applications, especially if the client forgets to properly encode the = characters.

Instead of a HashMap, use a LinkedHashMap, since that will keep the parameters in the same order as they appeared in the original URL. This makes the code easier to test (you do have unit tests, I hope) and more predictable in general.