public static String removeXSSCharacters(String input) {
        final String[] xss = { "<", ">", "\"", "'", "%", ";", ")", "(", "&",
                "+", "-" };
        for (String s : xss) {
            input = input.replace(s, "");
        }
        return input;
    }
Removes characters likely to enable Cross Site Scripting attacks from the
provided input string. The characters that are removed from the input
string, if present, are:

<pre>
&lt; &gt; &quot; ' % ; ) ( &amp; + -
</pre>

@param input the string to be scrubbed
@return Input without certain characters;
xmppserver/src/main/java/org/jivesoftware/util/StringUtils.java