code: private static String defangURI(String raw) 
    {
        StringBuffer buf = null;
        
        if (buf==null)
        {
            for (int i=0;i<raw.length();i++)
            {
                char c=raw.charAt(i);
                switch(c)
                {
                    case '\'':
                    case '"':
                    case '<':
                    case '>':
                        buf=new StringBuffer(raw.length()<<1);
                        break;
                }
            }
            if (buf==null)
                return raw;
        }
        
        for (int i=0;i<raw.length();i++)
        {
            char c=raw.charAt(i);       
            switch(c)
            {
              case '"':
                  buf.append("%22");
                  continue;
              case '\'':
                  buf.append("%27");
                  continue;
              case '<':
                  buf.append("%3C");
                  continue;
              case '>':
                  buf.append("%3E");
                  continue;
              default:
                  buf.append(c);
                  continue;
            }
        }
  
        return buf.toString();
    }
docs: Defang any characters that could break the URI string in an HREF.
  Such as <a href="/path/to;<script>Window.alert("XSS"+'%20'+"here");</script>">Link</a>
  
  The above example would parse incorrectly on various browsers as the "<" or '"' characters
  would end the href attribute value string prematurely.
  
  @param raw the raw text to defang.
  @return the defanged text.