public static String sanitizeUrlPart ( String theString ) { if ( theString == null ) { return null ; } boolean needsSanitization = isNeedsSanitization ( theString ) ; if ( needsSanitization ) { // Ok, we're sanitizing StringBuilder buffer = new StringBuilder ( theString . length ( ) + 10 ) ; for ( int j = 0 ; j < theString . length ( ) ; j ++ ) { char nextChar = theString . charAt ( j ) ; switch ( nextChar ) { case ' ' : buffer . append ( "&quot;" ) ; break ; case ' ' : buffer . append ( "&lt;" ) ; break ; default : buffer . append ( nextChar ) ; break ; } } // for build escaped string return buffer . toString ( ) ; } return theString ; }
This method specifically HTML - encodes the &quot ; and &lt ; characters in order to prevent injection attacks