title: Preventing xss attack in java web app while saving actual values in database
body: <p>In a Recent scan of our java based web application through AppScan it was found that the application was prone to XSS attacks.
  I did my research and found that a ServletFilter was probably the easiest way to protect the application.
  I introduced the filter where I extended HttpServletRequestWrapper (because java does not allow request param to be changed, there is no request.setParam method). I introduced a sanitize method there and here is what it does</p>
  
  <pre><code>result = ESAPI.encoder().canonicalize( input);
  
  // Avoid null characters
  result = result.replaceAll("\0", "");
  
  // Clean out HTML
  result = Jsoup.clean( result, Whitelist.none() );
  </code></pre>
  
  <p>Post this change, it was good, I tested for XSS vulnerabilites myself and most of them were fixed. But this posed another problem. Suppose I have a form to create a product, and in product name a user enters something like </p>
  
  <pre><code>&lt;script&gt;alert('somethingStupid')&lt;/script&gt;
  </code></pre>
  
  <p>Now Ideally I should be able to save this to database, but still be protected from XSS attack. Not sure what to do in my filter or anywhere else to achieve this.</p>