防xss攻击,需要对请求参数进行escape吗?

先看一个测试:

该接口用于测试协作方接口的应答状态码.

@RequestMapping("/testapi")    @ResponseBody    public String test(String apiPath, String requestMethod) throws IOException {        apiPath = HtmlUtils.htmlEscape(apiPath);        URL url = new URL(apiPath);        URLConnection urlConnection = url.openConnection();        HttpURLConnection httpUrlConnection = (HttpURLConnection) urlConnection;        httpUrlConnection.setDoInput(true);        httpUrlConnection.setUseCaches(false);        if (!ValueWidget.isNullOrEmpty(requestMethod)) {            httpUrlConnection.setRequestMethod(requestMethod);        }        httpUrlConnection.connect();        int responseStatusCode = httpUrlConnection.getResponseCode();        httpUrlConnection.disconnect();        System.out.println("responseStatusCode:" + responseStatusCode);        Map
     
       map = new HashMap
      
       ();        map.put("responseCode", responseStatusCode);        map.put("apiPath", apiPath);        return HWJacksonUtils.getJsonP(map);    }
      
     

看看协作方接口收到的参数:

apiPath = HtmlUtils.htmlEscape(apiPath);

所以对参数进行HTML escape时应该不处理&

修改HTML escape 的函数如下: