Use three-params-form.html to send data to the ThreeParams servlet that contains HTML-specific characters. Verify that this can cause malformed results. Make a variation of the servlet that filters the strings before displaying them. Be sure to copy ServletUtilities from the forms or test-app project first, so that you can simply do this:

someString = ServletUtilities.filter(someString);