title: Spring/Java - Encode HTML Entities + XHR
body: <p>When using regular JSP forms for printing to the client, configuring the web.xml properly works for me (http://stackoverflow.com/questions/2147958/how-do-i-prevent-people-from-doing-xss-in-java).</p>
  
  <p>Is there any "best practice" on how to escape/entityze strings which will be send via JSON to a jQuery function, which then populates the DOM with these values? Any recommended libraries or Spring Web Framework build-ins?</p>
  
  <ol>
  <li>jQuery $.ajax-call to Spring MVC</li>
  <li>Spring MVC responds in JSON</li>
  <li>(magic encoding happens, e.g. <code>&lt;a&gt;</code> becomes <code>&amp;lt;a&amp;gt;</code> ) &lt;= this one</li>
  <li>jQuery receives the JSON and populates the DOM XSS-safe</li>
  </ol>
  
  <p>Thanks in advance!</p>
  
  <p>edit: I am also sometimes sending HTML on purpose, so the solution would need to be able to only handle the user input. It will probably turn out that every user-poisoned string will have to be sanitized manually?</p>