WebApp Sec: Data sanitization approaches in Java

["Benjamin Livshits" <livshits () cs stanford edu>]

I was wondering about data sanitization strategies commonly used in
today's Web applications, especially those written using J2EE. I am
aware of libraries that would simplify the sanitization process for you,
however, I haven't really seen many applications that use anything more
sophisticated than URL-encoding the user-supplied string data.

Are there some common sanitization strategies that people actually use
in their code on a regular basis? 

Thanks in advance,
-Ben