Java - XSS - HTML encoding - reference of a character entity compared to a reference to a numerical object

Question

We searched for ways to encode HTML pages on JSP pages to support XSS.

OWASP site shows How_to_perform_HTML_entity_encoding_in_Java

The article talks about the entity encoding "Big 5" ie

  21          {"#39", new Integer(39)}, // ' - apostrophe
  22          {"quot", new Integer(34)}, // " - double-quote
  23          {"amp", new Integer(38)}, // & - ampersand
  24          {"lt", new Integer(60)}, // < - less-than
  25          {"gt", new Integer(62)}, // > - greater-than

i.e.

<script>

encoded as

  <script>

but the Java code sample included in the article uses numerical reference encoding ie

<script></script>

encoded as

 <script></script>

Is there a reason to use character references over entity references? Which is better and why?

Answer 1

This is the same as XSS protection. The only real practical differences are readability and size.