title: How to allow specific characters with OWASP HTML Sanitizer?
body: <p>I am using the OWASP Html Sanitizer to prevent XSS attacks on my web app. For many fields that should be plain text the Sanitizer is doing more than I expect. </p>
  
  <p>For example: </p>
  
  <pre><code>HtmlPolicyBuilder htmlPolicyBuilder = new HtmlPolicyBuilder();
  stripAllTagsPolicy = htmlPolicyBuilder.toFactory();
  stripAllTagsPolicy.sanitize('a+b'); // return a&amp;#43;b
  stripAllTagsPolicy.sanitize('foo@example.com'); // return foo&amp;#64;example.com
  </code></pre>
  
  <p>When I have fields such as email address that have a <code>+</code> in it such as <code>foo+bar@gmail.com</code> I end up with the wrong data in the the database. So two questions: </p>
  
  <ol>
  <li>Are characters such as <code>+ - @</code> dangerous on their own do they really need to be encoded? </li>
  <li>How do I configure the OWASP html sanitizer to allow specific characters such as + - @?</li>
  </ol>
  
  <p><strong>Question 2 is the more important one for me to get an answer to.</strong> </p>