code: public static String escapeHtml(String message) {
          StringBuffer b = new StringBuffer(message.length());
  
          for (int i = 0; i < message.length(); i++) {
              char ch = message.charAt(i);
  
              if (ch == '<') {
                  b.append("&lt;");
              } else if (ch == '>') {
                  b.append("&gt;");
              } else if (ch == '"') {
                  b.append("&quot;");
              } else if (ch == '\'') {
                  b.append("&#39;");
              } else if (ch == '&') {
                  b.append("&amp;");
              } else if (ch >= ' ' && ch <= '~') {
                  b.append(ch);
              } else if (Character.isWhitespace(ch)) {
                  b.append("&#").append((int) ch).append(";");
              } else if (Character.isISOControl(ch)) {
                  // Ignore character
              } else if (Character.isDefined(ch)) {
                  b.append("&#").append((int) ch).append(";");
              }
          }
  
          return b.toString();
      }
docs: escapeHtml(String) is based partly on the article posted here: http://www.owasp.org/index.php/How_to_perform_HTML_entity_encoding_in_Java
  with the addition of common characters and modifications for Java 1.4 support.
  
  @param message
  @return Returns a message where any HTML entity characters are escaped.