JAVA网页项目中如何处理XSS漏洞攻击呢?

只需对传入的参数进行替换
      即可实现参数过滤

public static  String xssEncode(String s) {
        if (s == null || s.equals("")) {
            return s;
        }
        try {
            s = URLDecoder.decode(s, "UTF-8");
        } catch (UnsupportedEncodingException e) {
            e.printStackTrace();
        }
        //< > ' " \ / # &
        s = s.replaceAll("<", "<").replaceAll(">", ">");
        s = s.replaceAll("\\(", "(").replaceAll("\\)", ")");
        s = s.replaceAll("'", "'");
        s = s.replaceAll("eval\\((.*)\\)", "");
        s = s.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
        s = s.replaceAll("script", "");
        s = s.replaceAll("#", "＃");
        s = s.replaceAll("%", "％");
        return s;
    }