public static String escapeHtml(String message) {
        StringBuffer b = new StringBuffer(message.length());

        for (int i = 0; i < message.length(); i++) {
            char ch = message.charAt(i);

            if (ch == '<') {
                b.append("&lt;");
            } else if (ch == '>') {
                b.append("&gt;");
            } else if (ch == '"') {
                b.append("&quot;");
            } else if (ch == '\'') {
                b.append("&#39;");
            } else if (ch == '&') {
                b.append("&amp;");
            } else if (ch >= ' ' && ch <= '~') {
                b.append(ch);
            } else if (Character.isWhitespace(ch)) {
                b.append("&#").append((int) ch).append(";");
            } else if (Character.isISOControl(ch)) {
                // Ignore character
            } else if (Character.isDefined(ch)) {
                b.append("&#").append((int) ch).append(";");
            }
        }

        return b.toString();
    }
public static String escapeHtml ( String message ) { StringBuffer b = new StringBuffer ( message . length ( ) ) ; for ( int i = 0 ; i < message . length ( ) ; i ++ ) { char ch = message . charAt ( i ) ; if ( ch == '<' ) { b . append ( "&lt;" ) ; } else if ( ch == '>' ) { b . append ( "&gt;" ) ; } else if ( ch == '"' ) { b . append ( "&quot;" ) ; } else if ( ch == '\'' ) { b . append ( "&#39;" ) ; } else if ( ch == '&' ) { b . append ( "&amp;" ) ; } else if ( ch >= ' ' && ch <= '~' ) { b . append ( ch ) ; } else if ( Character . isWhitespace ( ch ) ) { b . append ( "&#" ) . append ( ( int ) ch ) . append ( ";" ) ; } else if ( Character . isISOControl ( ch ) ) { } else if ( Character . isDefined ( ch ) ) { b . append ( "&#" ) . append ( ( int ) ch ) . append ( ";" ) ; } } return b . toString ( ) ; }
escapeHtml(String) is based partly on the article posted here: http://www.owasp.org/index.php/How_to_perform_HTML_entity_encoding_in_Java
with the addition of common characters and modifications for Java 1.4 support.

@param message
@return Returns a message where any HTML entity characters are escaped.