diff --git a/pom.xml b/pom.xml
index 3018816..494efcb 100644
--- a/pom.xml
+++ b/pom.xml
@@ -44,6 +44,12 @@
 			<artifactId>spring-boot-starter-test</artifactId>
 			<scope>test</scope>
 		</dependency>
+		<!--commons-->
+		<dependency>
+			<groupId>org.apache.commons</groupId>
+			<artifactId>commons-lang3</artifactId>
+			<version>3.7</version>
+		</dependency>
 		<!--mysql-->
 		<dependency>
 			<groupId>mysql</groupId>
diff --git a/src/main/java/com/xwolf/boot/interceptor/XSSFilter.java b/src/main/java/com/xwolf/boot/interceptor/XSSFilter.java
new file mode 100644
index 0000000..5eb5ce6
--- /dev/null
+++ b/src/main/java/com/xwolf/boot/interceptor/XSSFilter.java
@@ -0,0 +1,29 @@
+package com.xwolf.boot.interceptor;
+
+import javax.servlet.*;
+import javax.servlet.http.HttpServletRequest;
+import java.io.IOException;
+
+/**
+ * @author xwolf
+ * @since 1.8
+ */
+public class XSSFilter implements Filter {
+
+    private FilterConfig filterConfig = null;
+
+    @Override
+    public void init(FilterConfig filterConfig) throws ServletException {
+        this.filterConfig = filterConfig;
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
+        chain.doFilter(new XSSHttpServletRequestWrapper((HttpServletRequest) request), response);
+    }
+
+    @Override
+    public void destroy() {
+        this.filterConfig = null;
+    }
+}
diff --git a/src/main/java/com/xwolf/boot/interceptor/XSSHttpServletRequestWrapper.java b/src/main/java/com/xwolf/boot/interceptor/XSSHttpServletRequestWrapper.java
new file mode 100644
index 0000000..2220196
--- /dev/null
+++ b/src/main/java/com/xwolf/boot/interceptor/XSSHttpServletRequestWrapper.java
@@ -0,0 +1,57 @@
+package com.xwolf.boot.interceptor;
+
+
+import org.apache.commons.lang3.StringEscapeUtils;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletRequestWrapper;
+
+/**
+ * XSS 过滤
+ * @author xwolf
+ * @since 1.8
+ */
+public class XSSHttpServletRequestWrapper extends HttpServletRequestWrapper {
+    /**
+     * Constructs a request object wrapping the given request.
+     *
+     * @param request
+     * @throws IllegalArgumentException if the request is null
+     */
+    public XSSHttpServletRequestWrapper(HttpServletRequest request) {
+        super(request);
+    }
+
+    @Override
+    public String[] getParameterValues(String parameter) {
+        String[] values = super.getParameterValues(parameter);
+        if (values==null)  {
+            return null;
+        }
+        int count = values.length;
+        String[] encodedValues = new String[count];
+        for (int i = 0; i < count; i++) {
+            encodedValues[i] = StringEscapeUtils.escapeHtml4(values[i]).replace("'","''");
+        }
+        return encodedValues;
+    }
+    @Override
+    public String getParameter(String parameter) {
+        String value = super.getParameter(parameter);
+        if (value == null) {
+            return null;
+        }
+        return StringEscapeUtils.escapeHtml4(value).replace("'","''");
+    }
+    @Override
+    public String getHeader(String name) {
+        String value = super.getHeader(name);
+        if (value == null) {
+            return null;
+        }
+
+        return StringEscapeUtils.escapeHtml4(value).replace("'","''");
+    }
+
+
+}