过滤html恶意代码

/**
* 转义HTML特殊字符
*/
public static final String trunhtml(String html){
if(html == null)
return null;
final StringBuilder newhtml = new StringBuilder("");
final char[] chararray = html.toCharArray();
for(char c : chararray){
if(c == '\r')
continue;
if(c == '&')
newhtml.append("&");
else if(c == '#')
newhtml.append("#");
else if(c == '*')
newhtml.append("*");
else if(c == ':')
newhtml.append(":");
else if(c == ';')
newhtml.append(";");
else if(c == '<')
newhtml.append("<");
else if(c == '>')
newhtml.append(">");
else if(c == ' ')
newhtml.append(" ");
else if(c == '\n')
newhtml.append("<br />");
else if(c == '"')
newhtml.append(""");
else if(c == '\'')
newhtml.append("'");
else if(c == '/')
newhtml.append("/");
else if(c == '$')
newhtml.append("$");
else if(c == '(')
newhtml.append("(");
else if(c == ')')
newhtml.append(")");
else if(c == '{')
newhtml.append("{");
else if(c == '}')
newhtml.append("}");
else if(c == '*')
newhtml.append("*");
else if(c == '%')
newhtml.append("%");
else if(c == '+')
newhtml.append("+");
else if(c == '-')
newhtml.append("-");
else if(c == '~')
newhtml.append("~");
else if(c == '\t')
newhtml.append("    ");
else
newhtml.append(c);
}
return newhtml.toString();
}