title: request.getParameter protect against XSS : what is the best practice?
body: <p>I've inherited a large code base of 1000+ JSP-files that is full of XSS-vulnerabilities.</p>
  
  <p>The code is full of </p>
  
  <pre><code>&lt;%= request.getParameter("theparam")%&gt;
  </code></pre>
  
  <p>and</p>
  
  <pre><code>out.println("some stuff before"+request.getParameter("theparam")+"and some other stuff");
  </code></pre>
  
  <p>and</p>
  
  <pre><code>String myVar = request.getParameter("theparam");
  out.println(myVar);
  </code></pre>
  
  <p>I want to secure all files without having to go through all of them individually.</p>
  
  <p>What is my best approach ?</p>
  
  <ul>
  <li><p>Do a 'replace all' on "request.getParameter("xx")" to "StringEscapeUtils.escapeHtml(request.getParameter("xx")) on all source files ? </p></li>
  <li><p>Can i somehow override the function 'request.getParameter' so it defaults to stringescapeutils.escapehtml(request.getParameter("")); ?</p></li>
  </ul>
  
  <p>thnx</p>