title: How to escape-html in JSP before saving to database?
body: <p>I am learning JSP and Java at the moment and wrote a (very) simple guestbook to get started with JSP. But i want to ensure that noone can use CSS, so i need to strip the HTML code before saving it to my mySQL database. I already searched here and found the "
  
  <pre><code>  PreparedStatement pStmt = conn.prepareStatement("INSERT INTO test VALUES (ID, ?, ?)");
  
    pStmt.setString(1, request.getParameter("sender"));
    pStmt.setString(2, request.getParameter("text"));
    pStmt.executeUpdate();
  </code></pre>
  
  <p>So what would be the proper way to do this ?</p>