The platform currently uses ESAPI, the OWASP Enterprise Security API. To use it in a project, add this line to ivy.xml:
<dependency org="org.owasp" name="ESAPI" rev="2.0_rc6" transitive="false" />
To use it in a JSP:
<%@page import="org.owasp.esapi.ESAPI"%> var javaScriptVar = "<%= ESAPI.encoder().encodeForJavaScript(someInputFromTheUser) %>";
Please review this excellent resource: