entityMap|blocks|key|gu9e|text|StringEscapeUtils|type|unstyled|depth|inlineStyleRanges|entityRanges|data|abr37|来自|4btka|Apache+Commons+Lang|a0hjb|import+static+org.apache.commons.lang.StringEscapeUtils.escapeHtml;
//+...
String+source+=+"The+less+than+sign+(<)+and+ampersand+(&)+must+be+escaped+before+using+them+in+HTML";
String+escaped+=+escapeHtml(source);|code-block|syntax|javascript|dp9gt|对于|3pttm|版本3|27r7p|(|5kcs0|https://commons.apache.org/proper/commons-lang/javadocs/api-release/org/apache/commons/lang3/StringEscapeUtils.html#escapeHtml4(java.lang.String%2529)|9o5ae|import+static+org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;
//+...
String+escaped+=+escapeHtml4(source);^0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|V|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|W|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|X|9|@]|A|@]|B|$]]|$2|G|4|H|6|I|8|Y|9|@]|A|@]|B|$J|K]]|$2|L|4|M|6|7|8|Z|9|@]|A|@]|B|$]]|$2|N|4|O|6|7|8|10|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|11|9|@]|A|@]|B|$]]|$2|R|4|S|6|7|8|12|9|@]|A|@]|B|$]]|$2|T|4|U|6|I|8|13|9|@]|A|@]|B|$J|K]]]]

<a href="http://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringEscapeUtils.html" rel="noreferrer">StringEscapeUtils</a> from <a href="http://commons.apache.org/lang/" rel="noreferrer">Apache Commons Lang</a>:

<pre><code>import static org.apache.commons.lang.StringEscapeUtils.escapeHtml;
// ...
String source = "The less than sign (&lt;) and ampersand (&amp;) must be escaped before using them in HTML";
String escaped = escapeHtml(source);
</code></pre>

For <a href="https://commons.apache.org/proper/commons-lang/javadocs/api-release/org/apache/commons/lang3/StringEscapeUtils.html#escapeHtml4(java.lang.String)" rel="noreferrer">version 3</a>:

<pre><code>import static org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;
// ...
String escaped = escapeHtml4(source);
</code></pre>

entityMap|blocks|key|6ds2o|text|Apache+Commons的一个替代方案:使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|c7k68|弹簧|9i7jf|%25s|3bmaj|方法。^0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|I|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|J|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|K|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|L|9|@]|A|@]|B|$]]]]

An alternative to Apache Commons: Use <a href="http://www.springframework.org" rel="noreferrer">Spring</a>'s <code>HtmlUtils.htmlEscape(String input)</code> method.

entityMap|blocks|key|dedv9|text|出于某些目的，|type|unstyled|depth|inlineStyleRanges|entityRanges|data|10u3a|HtmlUtils|7i338|import+org.springframework.web.util.HtmlUtils;
[...]
HtmlUtils.htmlEscapeDecimal("&");+//gives+&
HtmlUtils.htmlEscape("&");+//gives+&|code-block|syntax|javascript^0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|J|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|K|9|@]|A|@]|B|$]]|$2|E|4|F|6|G|8|L|9|@]|A|@]|B|$H|I]]]]

For some purposes, <a href="http://static.springsource.org/spring/docs/1.2.x/api/org/springframework/web/util/HtmlUtils.html" rel="nofollow noreferrer">HtmlUtils</a>:

<pre><code>import org.springframework.web.util.HtmlUtils;
[...]
HtmlUtils.htmlEscapeDecimal("&amp;"); //gives &amp;#38;
HtmlUtils.htmlEscape("&amp;"); //gives &amp;amp;
</code></pre>

entityMap|blocks|key|3u5l3|text|有一个更新版本的|type|unstyled|depth|inlineStyleRanges|entityRanges|data|8ivdc|Apache+Commons+Lang库|5f950|并且它使用了一个不同的包名(org.apache.commons.lang3)。The+The+The|54m1d|现在有不同的静态方法来转义不同类型的文档(|1er1a|http://commons.apache.org/proper/commons-lang/javadocs/api-3.0/index.html|5ebkt|)。因此，要转义HTML+4.0版字符串：|6og0d|import+static+org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;

String+output+=+escapeHtml4("The+less+than+sign+(<)+and+ampersand+(&)+must+be+escaped+before+using+them+in+HTML");|code-block|syntax|javascript^0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|R|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|S|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|T|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|U|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|V|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|W|9|@]|A|@]|B|$]]|$2|M|4|N|6|O|8|X|9|@]|A|@]|B|$P|Q]]]]

There is a newer version of the <a href="http://commons.apache.org/proper/commons-lang/javadocs/api-3.0/index.html" rel="noreferrer">Apache Commons Lang library</a> and it uses a different package name (org.apache.commons.lang3). The <code>StringEscapeUtils</code> now has different static methods for escaping different types of documents (<a href="http://commons.apache.org/proper/commons-lang/javadocs/api-3.0/index.html" rel="noreferrer">http://commons.apache.org/proper/commons-lang/javadocs/api-3.0/index.html</a>). So to escape HTML version 4.0 string:

<pre><code>import static org.apache.commons.lang3.StringEscapeUtils.escapeHtml4;

String output = escapeHtml4("The less than sign (&lt;) and ampersand (&amp;) must be escaped before using them in HTML");
</code></pre>

entityMap|blocks|key|86sl8|text|对此要小心。HTML文档中有许多不同的“上下文”：元素内部、引用属性值、未引用属性值、URL属性、javascript、CSS等。您需要使用不同的编码方法来防止跨站点脚本(XSS)。检查|type|unstyled|depth|inlineStyleRanges|entityRanges|data|44c2m|OWASP+XSS预防小抄|fivo4|有关每个上下文的详细信息，请参阅。您可以在OWASP+ESAPI库中找到每个上下文的转义方法--|8dfki|https://github.com/ESAPI/esapi-java-legacy|8gdod|..。^0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|K|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|L|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|M|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|N|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|O|9|@]|A|@]|B|$]]]]

Be careful with this. There are a number of different 'contexts' within an HTML document: Inside an element, quoted attribute value, unquoted attribute value, URL attribute, javascript, CSS, etc... You'll need to use a different encoding method for each of these to prevent Cross-Site Scripting (XSS). Check <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html" rel="nofollow noreferrer">the OWASP XSS Prevention Cheat Sheet</a> for details on each of these contexts. You can find escaping methods for each of these contexts in the OWASP ESAPI library -- <a href="https://github.com/ESAPI/esapi-java-legacy" rel="nofollow noreferrer">https://github.com/ESAPI/esapi-java-legacy</a>.

entityMap|blocks|key|evko7|text|在android+(API+16或更高版本)上，您可以：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1nkrh|Html.escapeHtml(textToScape);|code-block|syntax|javascript|h5mk|或者对于较低的API：|dcg2g|TextUtils.htmlEncode(textToScape);^0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|L|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|M|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|N|9|@]|A|@]|B|$]]|$2|J|4|K|6|E|8|O|9|@]|A|@]|B|$F|G]]]]

On android (API 16 or greater) you can:

<pre><code>Html.escapeHtml(textToScape);
</code></pre>

or for lower API:

<pre><code>TextUtils.htmlEncode(textToScape);
</code></pre>

entityMap|blocks|key|53t27|text|While+@dfa的答案|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1pcce|很好，我以前也用过它，它不应该用来转义HTML+(或XML)|5i2l7|属性|6rj2a|否则，空格将被规范化(意味着所有相邻的空格字符都变成一个空格)。|b9kq|我之所以知道这一点，是因为我的库(JATL)中没有保留空格的属性存在错误。因此，我有一滴(复制n‘粘贴)|9bju6|类(我从JDOM中偷了一些)，用于区分属性和元素内容的转义|1ltfq|..。|1mmun|虽然这在过去可能没有那么重要(正确的属性转义)，但由于HTML5的使用，它越来越引起人们的兴趣|2j31d|属性用法。^0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|S|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|T|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|U|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|V|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|W|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|X|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|Y|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|Z|9|@]|A|@]|B|$]]|$2|Q|4|R|6|7|8|10|9|@]|A|@]|B|$]]]]

While @dfa answer of <code>org.apache.commons.lang.StringEscapeUtils.escapeHtml</code> is nice and I have used it in the past it should not be used for escaping HTML (or XML) attributes otherwise the whitespace will be normalized (meaning all adjacent whitespace characters become a single space).

I know this because I have had bugs filed against my library (JATL) for attributes where whitespace was not preserved. Thus I have a drop in (copy n' paste) <a href="https://code.google.com/p/jatl/source/browse/src/main/java/com/googlecode/jatl/MarkupUtils.java" rel="noreferrer">class (of which I stole some from JDOM) that differentiates the escaping of attributes and element content</a>.

While this may not have mattered as much in the past (proper attribute escaping) it is increasingly become of greater interest given the use use of HTML5's <code>data-</code> attribute usage.

entityMap|blocks|key|5ceu2|text|非常简短的方法：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|dh3af|public+static+String+escapeHTML(String+s)+{
++++StringBuilder+out+=+new+StringBuilder(Math.max(16,+s.length()));
++++for+(int+i+=+0;+i+<+s.length();+i%2B%2B)+{
++++++++char+c+=+s.charAt(i);
++++++++if+(c+>+127+%7C%7C+c+==+'"'+%7C%7C+c+==+'\''+%7C%7C+c+==+'<'+%7C%7C+c+==+'>'+%7C%7C+c+==+'&')+{
++++++++++++out.append("&#");
++++++++++++out.append((int)+c);
++++++++++++out.append(';');
++++++++}+else+{
++++++++++++out.append(c);
++++++++}
++++}
++++return+out.toString();
}|code-block|syntax|javascript|cgm4a|基于|kqgf|https://stackoverflow.com/a/8838023/1199155|emhm2|(那里缺少放大器)。if子句中选中的四个字符是128以下的唯一字符，根据|cemto|http://www.w3.org/TR/html4/sgml/entities.html^0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|P|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|Q|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|R|9|@]|A|@]|B|$]]|$2|J|4|K|6|7|8|S|9|@]|A|@]|B|$]]|$2|L|4|M|6|7|8|T|9|@]|A|@]|B|$]]|$2|N|4|O|6|7|8|U|9|@]|A|@]|B|$]]]]

Nice short method:

<pre><code>public static String escapeHTML(String s) {
 StringBuilder out = new StringBuilder(Math.max(16, s.length()));
 for (int i = 0; i &lt; s.length(); i++) {
 char c = s.charAt(i);
 if (c &gt; 127 || c == '"' || c == '\'' || c == '&lt;' || c == '&gt;' || c == '&amp;') {
 out.append("&amp;#");
 out.append((int) c);
 out.append(';');
 } else {
 out.append(c);
 }
 }
 return out.toString();
}
</code></pre>

Based on <a href="https://stackoverflow.com/a/8838023/1199155">https://stackoverflow.com/a/8838023/1199155</a> (the amp is missing there). The four characters checked in the if clause are the only ones below 128, according to <a href="http://www.w3.org/TR/html4/sgml/entities.html" rel="noreferrer">http://www.w3.org/TR/html4/sgml/entities.html</a>

entityMap|blocks|key|b83h|text|对于那些使用Google+Guava的用户：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|84khh|import+com.google.common.html.HtmlEscapers;
[...]
String+source+=+"The+less+than+sign+(<)+and+ampersand+(&)+must+be+escaped+before+using+them+in+HTML";
String+escaped+=+HtmlEscapers.htmlEscaper().escape(source);|code-block|syntax|javascript^0|0^^$0|$]|1|@$2|3|4|5|6|7|8|H|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|I|9|@]|A|@]|B|$F|G]]]]

For those who use Google Guava:

<pre><code>import com.google.common.html.HtmlEscapers;
[...]
String source = "The less than sign (&lt;) and ampersand (&amp;) must be escaped before using them in HTML";
String escaped = HtmlEscapers.htmlEscaper().escape(source);
</code></pre>

entityMap|blocks|key|422ca|text|不推荐使用org.apache.commons.lang3.StringEscapeUtils。您现在必须通过以下方式使用org.apache.commons.text.StringEscapeUtils|type|unstyled|depth|inlineStyleRanges|entityRanges|data|5fgun|org.apache.commons
++++++++commons-text
++++++++${commons.text.version}|code-block|syntax|javascript^0|0^^$0|$]|1|@$2|3|4|5|6|7|8|H|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|I|9|@]|A|@]|B|$F|G]]]]

org.apache.commons.lang3.StringEscapeUtils is now deprecated. You must now use org.apache.commons.text.StringEscapeUtils by 

<pre><code> &lt;dependency&gt;
 &lt;groupId&gt;org.apache.commons&lt;/groupId&gt;
 &lt;artifactId&gt;commons-text&lt;/artifactId&gt;
 &lt;version&gt;${commons.text.version}&lt;/version&gt;
 &lt;/dependency&gt;
</code></pre>

entityMap|blocks|key|751qp|text|Java+8%2B解决方案：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|6ec5f|public+static+String+escapeHTML(String+str)+{
++++return+str.chars().mapToObj(c+->+c+>+127+%7C%7C+"\"'<>&".indexOf(c)+!=+-1+?
+++++++"&#"+%2B+c+%2B+";"+:+String.valueOf((char)+c)).collect(Collectors.joining());
}|code-block|syntax|javascript|a9370|返回一个|2ftvh|字符串中的字符值。然后我们可以使用|a3b7e|要转义字符代码大于127的字符以及双引号(|f0ail|)，单引号(|d2to0|)，左尖括号(|bm05j|)、右尖括号(|dk13k|)和与号(|2i5go|)。|f1o33|将|a9asq|让我们重归于好。^0|0|0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|11|9|@]|A|@]|B|$]]|$2|C|4|D|6|E|8|12|9|@]|A|@]|B|$F|G]]|$2|H|4|I|6|7|8|13|9|@]|A|@]|B|$]]|$2|J|4|K|6|7|8|14|9|@]|A|@]|B|$]]|$2|L|4|M|6|7|8|15|9|@]|A|@]|B|$]]|$2|N|4|O|6|7|8|16|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|17|9|@]|A|@]|B|$]]|$2|R|4|S|6|7|8|18|9|@]|A|@]|B|$]]|$2|T|4|U|6|7|8|19|9|@]|A|@]|B|$]]|$2|V|4|W|6|7|8|1A|9|@]|A|@]|B|$]]|$2|X|4|Y|6|7|8|1B|9|@]|A|@]|B|$]]|$2|Z|4|10|6|7|8|1C|9|@]|A|@]|B|$]]]]

<h1>Java 8+ Solution:</h1>
<pre class="lang-java prettyprint-override"><code>public static String escapeHTML(String str) {
 return str.chars().mapToObj(c -&gt; c &gt; 127 || &quot;\&quot;'&lt;&gt;&amp;&quot;.indexOf(c) != -1 ?
 &quot;&amp;#&quot; + c + &quot;;&quot; : String.valueOf((char) c)).collect(Collectors.joining());
}
</code></pre>
<a href="https://docs.oracle.com/javase/8/docs/api/java/lang/CharSequence.html#chars--" rel="nofollow noreferrer"><code>String#chars</code></a> returns an <code>IntStream</code> of the char values from the String. We can then use <code>mapToObj</code> to escape the characters with a character code greater than 127 (non-ASCII characters) as well as the double quote (<code>&quot;</code>), single quote (<code>'</code>), left angle bracket (<code>&lt;</code>), right angle bracket (<code>&gt;</code>), and ampersand (<code>&amp;</code>). <code>Collectors.joining</code> concatenates the <code>String</code>s back together.
To better handle Unicode characters, <code>String#codePoints</code> can be used instead.
<pre><code>public static String escapeHTML(String str) {
 return str.codePoints().mapToObj(c -&gt; c &gt; 127 || &quot;\&quot;'&lt;&gt;&amp;&quot;.indexOf(c) != -1 ?
 &quot;&amp;#&quot; + c + &quot;;&quot; : new String(Character.toChars(c)))
 .collect(Collectors.joining());
}
</code></pre>

Is there a recommended way to escape <code>&lt;</code>, <code>&gt;</code>, <code>"</code> and <code>&amp;</code> characters when outputting HTML in plain Java code? (Other than manually doing the following, that is).

<pre><code>String source = "The less than sign (&lt;) and ampersand (&amp;) must be escaped before using them in HTML";
String escaped = source.replace("&lt;", "&amp;lt;").replace("&amp;", "&amp;amp;"); // ...
</code></pre>

What is the recommended way to escape HTML symbols in plain Java?

翻译质量差，导致语言生硬或混乱。

没有提供实际的解决方法或示例。

解答不清晰，无法理解或解决问题。

页面排版不美观，阅读体验差。

文章

问答

视频

学习中心

腾讯云实验室

直播

竞赛

腾讯云代码分析专区

腾讯iOA零信任安全管理系统专区

腾讯云架构师技术同盟交流圈

腾讯云数据库专区

腾讯云顾问专区

腾讯云原生专区

腾讯混元专区

腾讯云TCE专区

腾讯云Lighthouse专区

腾讯云HAI专区

腾讯云Edgeone专区

腾讯云存储专区

腾讯云智能专区

腾讯轻联专区 

腾讯云开发专区

TAPD专区

腾讯轻量云游戏服专区

腾讯云最具价值专家

腾讯云架构师技术同盟

腾讯云创作之星

腾讯云开发者先锋 

腾讯云代码助手

CODING DevOps

Cloud Studio

SDK中心

API中心

命令行工具

有没有推荐的逃生方法？ 和 在纯Java代码中输出HTML时是否包含字符？(除了手动执行以下操作外，即)。 String source = "The less than sign (<) and ampersand (&) must be escaped before using them in HTML";St...

问在Java中转义HTML的推荐方法
EN

Stack Overflow用户

社区

活动

圈层

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问在Java中转义HTML的推荐方法EN