html自动添加恶意代码,过滤html恶意代码

/**

* 转义HTML特殊字符

*/

public static final String trunhtml(String html){

if(html == null)

return null;

final StringBuilder newhtml = new StringBuilder("");

final char[] chararray = html.toCharArray();

for(char c : chararray){

if(c == '\r')

continue;

if(c == '&')

newhtml.append("&");

else if(c == '#')

newhtml.append("#");

else if(c == '*')

newhtml.append("*");

else if(c == ':')

newhtml.append(":");

else if(c == ';')

newhtml.append(";");

else if(c == '

newhtml.append("

else if(c == '>')

newhtml.append(">");

else if(c == ' ')

newhtml.append(" ");

else if(c == '\n')

newhtml.append("
");

else if(c == '"')

newhtml.append(""");

else if(c == '\'')

newhtml.append("'");

else if(c == '/')

newhtml.append("/");

else if(c == '$')

newhtml.append("$");

else if(c == '(')

newhtml.append("(");

else if(c == ')')

newhtml.append(")");

else if(c == '{')

newhtml.append("{");

else if(c == '}')

newhtml.append("}");

else if(c == '*')

newhtml.append("*");

else if(c == '%')

newhtml.append("%");

else if(c == '+')

newhtml.append("+");

else if(c == '-')

newhtml.append("-");

else if(c == '~')

newhtml.append("~");

else if(c == '\t')

newhtml.append("    ");

else

newhtml.append(c);

}

return newhtml.toString();

}