<p>escaping html is fine - it will remove <code>&lt;</code>'s and <code>&gt;</code>'s etc. </p>

<p>ive run into a problem where i am outputting a filename inside a comment tag eg. <code>&lt;!-- ${filename} --&gt;</code></p>

<p>of course things can be bad if you dont escape, so it becomes:
<code>&lt;!-- &lt;c:out value="${filename}"/&gt; --&gt;</code></p>

<p>the problem is that if the file has "--" in the name, all the html gets screwed, since youre not allowed to have <code>&lt;!-- -- --&gt;</code>. </p>

<p>the standard html escape doesnt escape these dashes, and i was wondering if anyone is familiar with a simple / standard way to escape them. </p>

Definition of a HTML comment
:
A comment declaration starts with <!, followed by zero or more comments, followed by >. A comment starts and ends with "--", and does not contain any occurrence of "--".
Of course the parsing of a comment is up to the browser.
Nothing strikes me as an obvious solution here, so I'd suggest you str_replace those double dashes out.