code: public static String escape(String v) {
          if (v==null)    return null;
  
          StringBuilder buf = new StringBuilder(v.length()+64);
          for( int i=0; i<v.length(); i++ ) {
              char ch = v.charAt(i);
              if(ch=='<')
                  buf.append("&lt;");
              else
              if(ch=='>')
                  buf.append("&gt;");
              else
              if(ch=='&')
                  buf.append("&amp;");
              else
                  buf.append(ch);
          }
          if (buf.length()==v.length())   return  v;  // unmodified
          return buf.toString();
      }
docs: Escapes HTML/XML unsafe characters for the PCDATA section.
  This method does not handle whitespace-preserving escape, nor attribute escapes.