Blocking javascript events on h:outputText where escape=true
<p>I work for a website which is sort of a social network, and people can send messages to anyone. There was a guy who sent a </p>

<blockquote>
  <p><code>&lt;script&gt;alert('bah');&lt;/script&gt;</code></p>
</blockquote>

<p>And it created a javascript:alert..</p>

<p>How can I prevent this to happen? </p>

<blockquote>
  <p>I've made a method that gets the text typed and if it's typed &lt; it
  transforms into <code>"&amp;#60;"</code> and > to <code>"&amp;#62;"</code></p>
</blockquote>

<p>But even doing this, the code above still worked. Is there anything else that I could do to prevent it to happen again?</p>
