There is an HTML input textbox that has id paramater of exampleId. When something is submitted in this textbox and then submitted a javascript/ajax call is made and the correct results are returned. Cross-site scripting is needed on this textbox so I added into the javascript:

testVal=htmlEncode($('#exampleId').val());
$('#exampleId').val(testVal);

That works. Its prevents any cross-site scripting attacked. But the problem I am now having is if someone enters the following example: hello? It updates the value in the textbox to hello&#63 which I do not want.

Is there a better way to prevent cross-site scripting or is there a way I can also decode the value in the textbox so it would still display hello? while still keeping the above xss prevention?