防止特殊字符报错，以及脆弱性攻击

//纯文本显示用，例如<div><font><span>

public static String htmlString( String str, boolean sub )
	{
		if ( sub && str == null ) return "-";


		return htmlString_replace( str );
	}
public static String htmlString_replace( String str )
	{
		String word1[] = { "&", "<", ">", "\"", "'", "(", ")" };
		String word2[] = { "&", "<", ">", """, "'", "(", ")" };


		str = StrNull( str );


		StringBuffer sb = new StringBuffer();
		int spcount = 0;
		for( int i = 0 ; i < str.length() ; i++ ){
			String tmp = str.substring( i, i + 1 );


			// 出现连续空格，则去除一个
			if ( tmp.equals(" ") ){
				spcount++;
				if( spcount % 2 == 0 ){
					sb.append(" ");
					spcount = 0;
				}else{
					sb.append(" ");
				}
				continue;
			}else{
				spcount = 0;
			}


			for( int j = 0 ; j < word1.length ; j++ ){
				tmp = tmp.replace(word1[j], word2[j]);
			}


			sb.append(tmp);
		}


		return sb.toString();
	}

//将参数传递给标签时使用，例如οnclick=update('<%=xxx.htmlString_js(form.getID()) %>')

public static String htmlString_js(String str){
		String word1[] = {"\\", "\"", "'", ">", "<"};
		String word2[] = {"\\\\", "\\\"", "\\'", "\\>", "\\<"};
		str = StrNull( str );
		for(int j = 0 ; j < word1.length ; j++){
			str = str.replace(word1[j], word2[j]);
		}
		return str;
	}

//html标签中使用，例如 input标签的value值

public static String htmlString_text( String str )
	{
		String word1[] = { "&", "\"", "'" };
		String word2[] = { "&", """, "'" };

		str = StrNull( str );

		for( int j = 0 ; j < word1.length ; j++ ){
			str = str.replace(word1[j], word2[j]);
		}

		return str;
	}