过滤html恶意代码

    /**
     * 转义HTML特殊字符
     */
    public static final String trunhtml(String html){
        if(html == null)
            return null;
        final StringBuilder newhtml = new StringBuilder("");
        final char[] chararray = html.toCharArray();
        for(char c : chararray){
            if(c == '\r')
                continue;
            if(c == '&')
                newhtml.append("&");
            else if(c == '#')
                newhtml.append("#");
            else if(c == '*')
                newhtml.append("*");
            else if(c == ':')
                newhtml.append(":");
            else if(c == ';')
                newhtml.append(";");
            else if(c == '<')
                newhtml.append("<");
            else if(c == '>')
                newhtml.append(">");
            else if(c == ' ')
                newhtml.append(" ");
            else if(c == '\n')
                newhtml.append("<br />");
            else if(c == '"')
                newhtml.append(""");
            else if(c == '\'')
                newhtml.append("'");
            else if(c == '/')
                newhtml.append("/");
            else if(c == '$')
                newhtml.append("$");
            else if(c == '(')
                newhtml.append("(");
            else if(c == ')')
                newhtml.append(")");
            else if(c == '{')
                newhtml.append("{");
            else if(c == '}')
                newhtml.append("}");
            else if(c == '*')
                newhtml.append("*");
            else if(c == '%')
                newhtml.append("%");
            else if(c == '+')
                newhtml.append("+");
            else if(c == '-')
                newhtml.append("-");
            else if(c == '~')
                newhtml.append("~");
            else if(c == '\t')
                newhtml.append("    ");
            else
                newhtml.append(c);
        }
        return newhtml.toString();
    }