code: private static String filterValue(String value) 
              throws IOException {
          InternalStringBuilder result = new InternalStringBuilder(value.length());
          
          for (int i = 0; i < value.length(); ++i) {
              char c = value.charAt(i);
              switch (c) {
                  case '<':
                      result.append("&lt;");
                      break;
                  case '>':
                      result.append("&gt;");
                      break;
                  case '&':
                      result.append("&amp;");
                      break;
                  default:
                      result.append(c);
              }
          }
          
          return result.toString();
      }
docs: Filter output to prevent cross-site scripting (XSS) attacks.