code: public static String escapeForHTML(String s) {
          // TODO: do this in a single pass instead of creating 5 junk strings
          String escaped = s.replaceAll("&","&amp;");
          return escaped.replaceAll("<","&lt;");
      }
docs: Minimally escapes a string so that it can be placed inside XML/HTML
  attribute.
  Escapes lt and amp.
  @param s The string to escape
  @return The same string escaped.