Xss防御-特殊字符处理

public static String toHTML(String text, boolean isEscapeSpace)
{
if ((text == null) || ("".equals(text))) {
return "";
}

char[] content = new char[text.length()];
text.getChars(0, text.length(), content, 0);
StringBuilder result = new StringBuilder();
for (int i = 0; i < content.length; i++) {
switch (content[i]) {
case '\n':
result.append("<br/>");
break;
case '\r':
break;

case '<':
result.append("<");
break;
case '>':
result.append(">");
break;
case '&':
result.append("&");
break;
case '\'':
result.append("'");
break;
case '"':
result.append(""");
break;
case ' ':
if (isEscapeSpace) {
result.append(" ");
}
else {
result.append(content[i])
}
break;
default:
result.append(content[i]);
}

}
return result.toString();
}