code: public static String escapeHTML(String s) {
      // this version is much faster than using s.replaceAll()
      StringBuilder sb = new StringBuilder();
      int n = s.length();
      for (int i = 0; i < n; i++) {
        char c = s.charAt(i);
        switch (c) {
          case '<':
            sb.append("&lt;");
            break;
          case '>':
            sb.append("&gt;");
            break;
          case '&':
            sb.append("&amp;");
            break;
          case '"':
            sb.append("&quot;");
            break;
          default:
            sb.append(c);
            break;
        }
      }
      return sb.toString();
    }
docs: Escapes these characters: less than, greater than, quote, ampersand.