How to fix the Cross-Site Scripting (XSS) issue of penetration testing?

Hi All,
 We have java web application where we have some external web service. We are planning to migrate to cloud so cyber security scan the code and provided pen test results. We have more than 600 error regarding Cross-Site-Scripting (XSS). I would like to have your help for the solution. I am attaching the comment and the few line of codes where they have problem.

Below are the comment from the result.

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) 
Description This call contains a cross-site scripting (XSS) flaw.  The application populates the HTTP response with untrusted input, allowing an attacker to embed malicious content, such as Javascript code, which will be executed in the context of the victim's browser.  XSS vulnerabilities are commonly exploited to steal or manipulate cookies, modify presentation of content, and compromise confidential information, with new attack vectors being discovered on a regular basis.

Recommendations Use contextual escaping on all untrusted data before using it to construct any portion of an HTTP response.  The escaping method should be chosen based on the specific use case of the untrusted data, otherwise it may not protect fully against the attack. For example, if the data is being written to the body of an HTML page, use HTML entity escaping; if the data is being written to an attribute, use attribute escaping; etc.  When a web framework provides builtin support for automatic XSS escaping, do not disable it.  Both the OWASP Java Encoder library for Java and the Microsoft AntiXSS library provide contextual escaping methods.

Code

<td>
                                        p_session (Session Id) : <input type="text" name="p_session" size="50" maxlength="50" value='<%=p_session %>'>
                                        <br>
                                        p_part_nr (Number) : <input type="text" name="p_nr" size="20" maxlength="20" value='<%=p_part_nr %>'>
                                        &nbsp; &nbsp;
                                        p_ctry_cd (Code) : <input type="text" name="p_cd" size="4" maxlength="4" value='<%=p_ctry_cd %>'>
                                        &nbsp; &nbsp;

Select allOpen in new window

Let me know if you need more information.

Thank you for your Help.