xss漏洞修复思路

public static String htmlSecurityEscape(String str) {
        if (str == null) {
            return null;
        } else {
            StringBuilder sb = null;
            int len = str.length();

            try {
                for(int i = 0; i < len; ++i) {
                    char ch = str.charAt(i);
                    switch(ch) {
                    case '"':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append(""");
                        break;
                    case '&':
                        int in = str.indexOf(59, i + 1);
                        if (in != -1 && in - i < 9 && str.substring(i + 1, in).indexOf(38) == -1) {
                            if (sb != null) {
                                sb.append(ch);
                            }
                            break;
                        }

                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("&");
                        break;
                    case '\'':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("'");
                        break;
                    case '*':
                        if (i + 1 < str.length() && str.charAt(i + 1) == '/') {
                            if (sb == null) {
                                sb = new StringBuilder(str.length() << 1);
                                sb.append(str, 0, i);
                            }

                            sb.append("*/");
                            ++i;
                        } else if (sb != null) {
                            sb.append(ch);
                        }
                        break;
                    case '/':
                        if (i + 1 < str.length() && str.charAt(i + 1) == '*') {
                            if (sb == null) {
                                sb = new StringBuilder(str.length() << 1);
                                sb.append(str, 0, i);
                            }

                            sb.append("/*");
                            ++i;
                        } else if (sb != null) {
                            sb.append(ch);
                        }
                        break;
                    case '<':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("<");
                        break;
                    case '>':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append(">");
                        break;
                    case '\\':
                        if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }

                        sb.append("\\­");
                        break;
                    default:
                        if (Character.getDirectionality(ch) != 2 && Character.getDirectionality(ch) != 16 && Character.getDirectionality(ch) != 17) {
                            if (sb != null) {
                                sb.append(ch);
                            }
                        } else if (sb == null) {
                            sb = new StringBuilder(str.length() << 1);
                            sb.append(str, 0, i);
                        }
                    }
                }
            } catch (Exception var6) {
                var6.printStackTrace();
                System.err.println(str);
            }

            return null != sb ? sb.toString() : str;
        }
    }