import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; public class MyRequestWrapper extends HttpServletRequestWrapper { public MyRequestWrapper(HttpServletRequest arg0) { super(arg0); } public String getParameter(String name){ String value = super.getParameter(name); if(null != value){ return toHtml(value.trim()); }else{ return null; } } public String toHtml(String str){ if(str == null){ return null; } StringBuffer sb = new StringBuffer(); int len = str.length(); for(int i=0; i<len;i++){ char c = str.charAt(i); switch(c){ case ' ': sb.append(" ");break; case '<': sb.append("<");break; case '>': sb.append(">");break; case '&': sb.append("&");break; case '"': sb.append(""");break; case '//': sb.append("/");break; default: sb.append(c); } } return sb.toString(); } } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { chain.doFilter(new MyRequestWrapper((HttpServletRequest) request), response); }