Protect jsp againt xss pages

Question

I want to protect the form of my xss website, and I want all my data to be correct and consistent, so I don't want to allow any scripts to be added to my db, because my data can be used by other web services, so I I want to be sure that my data is correct and will not cause any problems for others.

I want to do validation only in the input, and not in the output, so I will do the check only once, and also be sure that no scripts exist in my db.

EDIT : please add the last comment I added.

Answer 1

Use a filter to clear the HTTP request data.

jsoup, :

String unsafe = "<p><a href='http://example.com/' onclick='stealCookies()'>Link</a></p>";
String safe = Jsoup.clean(unsafe, Whitelist.basic());
// now: <p><a href="http://example.com/" rel="nofollow">Link</a></p>

: http://jsoup.org/cookbook/cleaning-html/whitelist-sanitizer

Answer 2

http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

Answer 3

In short, you can write a filter that properly escapes user input (matching with the corresponding URL mapping). There may be a plugin available for this, but I don't know.
You can refer to this topic XSS Prevention in the JSP / Servlet Web Application