title: Apache Commons Text StringEscapeUtils vs JSoup for XSS prevention?
body: <p>I want to clean user input for help preventing XSS attacks and we don't necessarily care to have a HTML whitelist, as our users shouldn't need to post any HTML / CSS.</p>
  <p>Eyeing the alternatives out there, which would be better?  [Apache Commons Text's StringEscapeUtils] [1] or [JSoup Cleaner][2]?</p>
  <p>Thanks!</p>
  <p><strong>Update:</strong></p>
  <p>I went with JSoup after writing some unit tests for both it and Apache Commons Text.</p>
  <p>I like how JSoup won't mess with single quotation marks (i.e. &quot;Alan's mom&quot; isn't unchanged, whereas Apache Commons Text turns it into &quot;Alan's mom&quot;).</p>
  <p>And the whitelist wasn't a problem at all. It didn't require any configuration, rather, they have some built-in options included which may come in handy if we choose to allow some subsets of HTML tags.
  [1]: <a href="https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringEscapeUtils.html" rel="nofollow noreferrer">https://commons.apache.org/proper/commons-text/apidocs/org/apache/commons/text/StringEscapeUtils.html</a>
  [2]: <a href="http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer" rel="nofollow noreferrer">http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer</a></p>