Need help in identifying the difference between ESAPI.validator() and ESAPI.encoder()
<p>We are implementing application security in our website. Its a REST based application, so i will have to validate the whole request payload, rather than each attribute. This payload need to be validated against all type of attacks (SQL,XSS etc). While browsing i found people are using ESAPI for web security.</p>

<p>I am confused between  <code>ESAPI.validator().getValidXXX</code>, <code>ESAPI.encoder()</code> Java API's of ESAPI library. What is the difference between these two and when to use which API. I would also like to know in what cases we might use both API's</p>

<p>As per my understanding i could encode an input to form a valid html using both API's
Eg: </p>

<ol>
<li><code>ESAPI.encoder().encodeForHTML(input);</code></li>
<li><code>ESAPI.validator().getValidSafeHTML(context, input, maxLength, allowNull)</code>.</li>
</ol>

<p>For XSS attacks, I have made code changes to strip-of html tags using java pettern&amp;matcher, but i would like to achieve the same using ESAPI. Can someone help me how to achieve it.</p>

<p>Or</p>

<p>Are there any new java plugins developed for websecurity similar to ESAPI which i did not come accross. I have found <a href="https://jsoup.org/" rel="nofollow noreferrer">https://jsoup.org/</a>, but it solves only XSS attacks, i am looking for a library which provides API's for several attacks (SQL injection/XSS)</p>