title: XSS Cross Site Scripting - on JSP input tag
body: <p>The following piece of code in my JSP caused a cross site scripting vulnerability on the input tag.   </p>
  
  <pre><code>&lt;td id="locale-block" align="left" style="visibility: hidden; height: 0;"&gt;
      &lt;input type="text" id="locale" name="locale" text="eng" value = "eng"&gt;eng
  &lt;/td&gt;
  </code></pre>
  
  <p>During Penetration testing they were able to alert some random message to the user by injecting a alert script in the value attribute of the tag as follows</p>
  
  <pre><code>&lt;/script&gt;&lt;script&gt;alert(1);&lt;/script&gt;&lt;script&gt;
  </code></pre>
  
  <p>What should be done to avoid this? Is there any simple solution which does not involve paid 3rd party paid library?</p>