title: Does HTML encoding prevent XSS security exploits?
body: <p>By simply converting the following ("the big 5"):</p>
  
  <pre><code>&amp; -&gt; &amp;amp;
  &lt; -&gt; &amp;lt;
  &gt; -&gt; &amp;gt;
  " -&gt; &amp;#034;
  ' -&gt; &amp;#039;
  </code></pre>
  
  <p>Will you prevent XSS attacks?</p>
  
  <p>I think you need to white list at a character level too, to prevent <a href="http://ha.ckers.org/xss.html" rel="noreferrer">certain attacks</a>, but the <a href="https://stackoverflow.com/questions/2333586/java-5-html-escaping-to-prevent-xss/2333900#2333900">following answer</a> states it overcomplicates matters.</p>
  
  <p><strong>EDIT</strong> This <a href="http://www.owasp.org/index.php/How_to_perform_HTML_entity_encoding_in_Java" rel="noreferrer">page</a> details <code>it does not prevent more elaborate injections, does not help with "out of range characters = question marks" when outputting Strings to Writers with single byte encodings, nor prevents character reinterpretation when user switches browser encoding over displayed page.</code> In essence just escaping these characters seems to be quite a naive approach.</p>