css - Servlet reflected cross site scripting vulnerability -

i've analyzed code findbugs , reported warning

servlet reflected cross site scripting vulnerability.

code , 3rd line throws warning:

string tickname = request.getparameter("ticko"); printwriter w = response.getwriter(); w.println("unable perform tickonem '" + tickname +"' because no tick name active!"); //this line throws warning. 

what real reason , how fix it?

reason appending user provided data response without escaping. vulnerable injecting javascript executed in user browser. avoid such vulnerabilities should html escape every user supplied data before sending back. can use existing libraries perform escaping example stringescapeutils