Question

I use AntiSamy to sanitize user input and it works well. There is one problem: it encodes single and double quotes. So if I want to edit something, my sample's is rendered instead of my sample's–the single-quote becomes encoded.

To clarify: The broswer renders the quotes correctly, but they get saved in my db as HTML entities. So when a user loads a post for editing, the HTML entities are displayed in the text field.

1. Is there a way to get around this limitation?
2. Should I use/are there any different tool?

My users can post code and a variety of other stuff. So AntiSamy does a great job there. But I don’t want to convert single and double quotes in normal text.

What options do I have?

Answer 1

String s = "string unencode ' "NOW"";
String unencoded = s.replaceAll("'", "'").replaceAll(""","\"");
myTextField.setText(unencoded);