diff --git a/bundles/org.openhab.binding.amazonechocontrol/pom.xml b/bundles/org.openhab.binding.amazonechocontrol/pom.xml
index 336fba1fa4429..ab1d11f0b4abb 100644
--- a/bundles/org.openhab.binding.amazonechocontrol/pom.xml
+++ b/bundles/org.openhab.binding.amazonechocontrol/pom.xml
@@ -14,4 +14,13 @@
 
   <name>openHAB Add-ons :: Bundles :: Amazon Echo Control Binding</name>
 
+  <dependencies>
+    <dependency>
+      <groupId>org.unbescape</groupId>
+      <artifactId>unbescape</artifactId>
+      <version>1.1.6.RELEASE</version>
+      <scope>compile</scope>
+    </dependency>
+  </dependencies>
+
 </project>
diff --git a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/AccountServlet.java b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/AccountServlet.java
index 7d75f244545fc..d80f8720892a1 100644
--- a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/AccountServlet.java
+++ b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/AccountServlet.java
@@ -29,7 +29,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.eclipse.jdt.annotation.NonNullByDefault;
 import org.eclipse.jdt.annotation.Nullable;
 import org.openhab.binding.amazonechocontrol.internal.handler.AccountHandler;
@@ -46,6 +45,7 @@
 import org.osgi.service.http.NamespaceException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.unbescape.html.HtmlEscape;
 
 import com.google.gson.Gson;
 import com.google.gson.JsonSyntaxException;
@@ -365,27 +365,27 @@ private void handleChangeDomain(HttpServletResponse resp, Connection connection)
     private void handleDefaultPageResult(HttpServletResponse resp, String message, Connection connection)
             throws IOException {
         StringBuilder html = createPageStart("");
-        html.append(StringEscapeUtils.escapeHtml(message));
+        html.append(HtmlEscape.escapeHtml4(message));
         // logout link
         html.append(" <a href='" + servletUrl + "/logout' >");
-        html.append(StringEscapeUtils.escapeHtml("Logout"));
+        html.append(HtmlEscape.escapeHtml4("Logout"));
         html.append("</a>");
         // newdevice link
         html.append(" | <a href='" + servletUrl + "/newdevice' >");
-        html.append(StringEscapeUtils.escapeHtml("Logout and create new device id"));
+        html.append(HtmlEscape.escapeHtml4("Logout and create new device id"));
         html.append("</a>");
         // customer id
         html.append("<br>Customer Id: ");
-        html.append(StringEscapeUtils.escapeHtml(connection.getCustomerId()));
+        html.append(HtmlEscape.escapeHtml4(connection.getCustomerId()));
         // customer name
         html.append("<br>Customer Name: ");
-        html.append(StringEscapeUtils.escapeHtml(connection.getCustomerName()));
+        html.append(HtmlEscape.escapeHtml4(connection.getCustomerName()));
         // device name
         html.append("<br>App name: ");
-        html.append(StringEscapeUtils.escapeHtml(connection.getDeviceName()));
+        html.append(HtmlEscape.escapeHtml4(connection.getDeviceName()));
         // connection
         html.append("<br>Connected to: ");
-        html.append(StringEscapeUtils.escapeHtml(connection.getAlexaServer()));
+        html.append(HtmlEscape.escapeHtml4(connection.getAlexaServer()));
         // domain
         html.append(" <a href='");
         html.append(servletUrl);
@@ -394,7 +394,7 @@ private void handleDefaultPageResult(HttpServletResponse resp, String message, C
         // Main UI link
         html.append("<br><a href='/#!/settings/things/" + BINDING_ID + ":"
                 + URLEncoder.encode(THING_TYPE_ACCOUNT.getId(), "UTF8") + ":" + URLEncoder.encode(id, "UTF8") + "'>");
-        html.append(StringEscapeUtils.escapeHtml("Check Thing in Main UI"));
+        html.append(HtmlEscape.escapeHtml4("Check Thing in Main UI"));
         html.append("</a><br><br>");
 
         // device list
@@ -403,28 +403,28 @@ private void handleDefaultPageResult(HttpServletResponse resp, String message, C
         for (Device device : this.account.getLastKnownDevices()) {
 
             html.append("<tr><td>");
-            html.append(StringEscapeUtils.escapeHtml(nullReplacement(device.accountName)));
+            html.append(HtmlEscape.escapeHtml4(nullReplacement(device.accountName)));
             html.append("</td><td>");
-            html.append(StringEscapeUtils.escapeHtml(nullReplacement(device.serialNumber)));
+            html.append(HtmlEscape.escapeHtml4(nullReplacement(device.serialNumber)));
             html.append("</td><td>");
-            html.append(StringEscapeUtils.escapeHtml(device.online ? "Online" : "Offline"));
+            html.append(HtmlEscape.escapeHtml4(device.online ? "Online" : "Offline"));
             html.append("</td><td>");
             Thing accountHandler = account.findThingBySerialNumber(device.serialNumber);
             if (accountHandler != null) {
                 html.append("<a href='" + servletUrl + "/ids/?serialNumber="
                         + URLEncoder.encode(device.serialNumber, "UTF8") + "'>"
-                        + StringEscapeUtils.escapeHtml(accountHandler.getLabel()) + "</a>");
+                        + HtmlEscape.escapeHtml4(accountHandler.getLabel()) + "</a>");
             } else {
                 html.append("<a href='" + servletUrl + "/ids/?serialNumber="
-                        + URLEncoder.encode(device.serialNumber, "UTF8") + "'>"
-                        + StringEscapeUtils.escapeHtml("Not defined") + "</a>");
+                        + URLEncoder.encode(device.serialNumber, "UTF8") + "'>" + HtmlEscape.escapeHtml4("Not defined")
+                        + "</a>");
             }
             html.append("</td><td>");
-            html.append(StringEscapeUtils.escapeHtml(nullReplacement(device.deviceFamily)));
+            html.append(HtmlEscape.escapeHtml4(nullReplacement(device.deviceFamily)));
             html.append("</td><td>");
-            html.append(StringEscapeUtils.escapeHtml(nullReplacement(device.deviceType)));
+            html.append(HtmlEscape.escapeHtml4(nullReplacement(device.deviceType)));
             html.append("</td><td>");
-            html.append(StringEscapeUtils.escapeHtml(nullReplacement(device.deviceOwnerCustomerId)));
+            html.append(HtmlEscape.escapeHtml4(nullReplacement(device.deviceOwnerCustomerId)));
             html.append("</td>");
             html.append("</tr>");
         }
@@ -434,8 +434,7 @@ private void handleDefaultPageResult(HttpServletResponse resp, String message, C
 
     private void handleDevices(HttpServletResponse resp, Connection connection)
             throws IOException, URISyntaxException, InterruptedException {
-        returnHtml(connection, resp,
-                "<html>" + StringEscapeUtils.escapeHtml(connection.getDeviceListJson()) + "</html>");
+        returnHtml(connection, resp, "<html>" + HtmlEscape.escapeHtml4(connection.getDeviceListJson()) + "</html>");
     }
 
     private String nullReplacement(@Nullable String text) {
@@ -448,16 +447,16 @@ private String nullReplacement(@Nullable String text) {
     StringBuilder createPageStart(String title) {
         StringBuilder html = new StringBuilder();
         html.append("<html><head><title>"
-                + StringEscapeUtils.escapeHtml(BINDING_NAME + " - " + this.account.getThing().getLabel()));
+                + HtmlEscape.escapeHtml4(BINDING_NAME + " - " + this.account.getThing().getLabel()));
         if (!title.isEmpty()) {
             html.append(" - ");
-            html.append(StringEscapeUtils.escapeHtml(title));
+            html.append(HtmlEscape.escapeHtml4(title));
         }
         html.append("</title><head><body>");
-        html.append("<h1>" + StringEscapeUtils.escapeHtml(BINDING_NAME + " - " + this.account.getThing().getLabel()));
+        html.append("<h1>" + HtmlEscape.escapeHtml4(BINDING_NAME + " - " + this.account.getThing().getLabel()));
         if (!title.isEmpty()) {
             html.append(" - ");
-            html.append(StringEscapeUtils.escapeHtml(title));
+            html.append(HtmlEscape.escapeHtml4(title));
         }
         html.append("</h1>");
         return html;
@@ -466,7 +465,7 @@ StringBuilder createPageStart(String title) {
     private void createPageEndAndSent(HttpServletResponse resp, StringBuilder html) {
         // account overview link
         html.append("<br><a href='" + servletUrl + "/../' >");
-        html.append(StringEscapeUtils.escapeHtml("Account overview"));
+        html.append(HtmlEscape.escapeHtml4("Account overview"));
         html.append("</a><br>");
 
         html.append("</body></html>");
@@ -497,14 +496,13 @@ private void handleIds(HttpServletResponse resp, Connection connection, Device d
     private void renderCapabilities(Connection connection, Device device, StringBuilder html) {
         html.append("<h2>Capabilities</h2>");
         html.append("<table><tr><th align='left'>Name</th></tr>");
-        device.getCapabilities().forEach(capability -> html.append("<tr><td>")
-                .append(StringEscapeUtils.escapeHtml(capability)).append("</td></tr>"));
+        device.getCapabilities().forEach(
+                capability -> html.append("<tr><td>").append(HtmlEscape.escapeHtml4(capability)).append("</td></tr>"));
         html.append("</table>");
     }
 
     private void renderMusicProviderIdChannel(Connection connection, StringBuilder html) {
-        html.append("<h2>").append(StringEscapeUtils.escapeHtml("Channel " + CHANNEL_MUSIC_PROVIDER_ID))
-                .append("</h2>");
+        html.append("<h2>").append(HtmlEscape.escapeHtml4("Channel " + CHANNEL_MUSIC_PROVIDER_ID)).append("</h2>");
         html.append("<table><tr><th align='left'>Name</th><th align='left'>Value</th></tr>");
         List<JsonMusicProvider> musicProviders = connection.getMusicProviders();
         for (JsonMusicProvider musicProvider : musicProviders) {
@@ -515,9 +513,9 @@ private void renderMusicProviderIdChannel(Connection connection, StringBuilder h
                     && !providerId.isEmpty() && "AVAILABLE".equals(musicProvider.availability) && displayName != null
                     && !displayName.isEmpty()) {
                 html.append("<tr><td>");
-                html.append(StringEscapeUtils.escapeHtml(displayName));
+                html.append(HtmlEscape.escapeHtml4(displayName));
                 html.append("</td><td>");
-                html.append(StringEscapeUtils.escapeHtml(providerId));
+                html.append(HtmlEscape.escapeHtml4(providerId));
                 html.append("</td></tr>");
             }
         }
@@ -525,7 +523,7 @@ private void renderMusicProviderIdChannel(Connection connection, StringBuilder h
     }
 
     private void renderPlayAlarmSoundChannel(Connection connection, Device device, StringBuilder html) {
-        html.append("<h2>").append(StringEscapeUtils.escapeHtml("Channel " + CHANNEL_PLAY_ALARM_SOUND)).append("</h2>");
+        html.append("<h2>").append(HtmlEscape.escapeHtml4("Channel " + CHANNEL_PLAY_ALARM_SOUND)).append("</h2>");
         List<JsonNotificationSound> notificationSounds = List.of();
         String errorMessage = "No notifications sounds found";
         try {
@@ -542,20 +540,20 @@ private void renderPlayAlarmSoundChannel(Connection connection, Device device, S
                     String providerSoundId = notificationSound.providerId + ":" + notificationSound.id;
 
                     html.append("<tr><td>");
-                    html.append(StringEscapeUtils.escapeHtml(notificationSound.displayName));
+                    html.append(HtmlEscape.escapeHtml4(notificationSound.displayName));
                     html.append("</td><td>");
-                    html.append(StringEscapeUtils.escapeHtml(providerSoundId));
+                    html.append(HtmlEscape.escapeHtml4(providerSoundId));
                     html.append("</td></tr>");
                 }
             }
             html.append("</table>");
         } else {
-            html.append(StringEscapeUtils.escapeHtml(errorMessage));
+            html.append(HtmlEscape.escapeHtml4(errorMessage));
         }
     }
 
     private void renderAmazonMusicPlaylistIdChannel(Connection connection, Device device, StringBuilder html) {
-        html.append("<h2>").append(StringEscapeUtils.escapeHtml("Channel " + CHANNEL_AMAZON_MUSIC_PLAY_LIST_ID))
+        html.append("<h2>").append(HtmlEscape.escapeHtml4("Channel " + CHANNEL_AMAZON_MUSIC_PLAY_LIST_ID))
                 .append("</h2>");
 
         JsonPlaylists playLists = null;
@@ -578,9 +576,9 @@ private void renderAmazonMusicPlaylistIdChannel(Connection connection, Device de
                             PlayList playList = innerLists[0];
                             if (playList != null && playList.playlistId != null && playList.title != null) {
                                 html.append("<tr><td>");
-                                html.append(StringEscapeUtils.escapeHtml(nullReplacement(playList.title)));
+                                html.append(HtmlEscape.escapeHtml4(nullReplacement(playList.title)));
                                 html.append("</td><td>");
-                                html.append(StringEscapeUtils.escapeHtml(nullReplacement(playList.playlistId)));
+                                html.append(HtmlEscape.escapeHtml4(nullReplacement(playList.playlistId)));
                                 html.append("</td></tr>");
                             }
                         }
@@ -588,13 +586,13 @@ private void renderAmazonMusicPlaylistIdChannel(Connection connection, Device de
                 }
                 html.append("</table>");
             } else {
-                html.append(StringEscapeUtils.escapeHtml(errorMessage));
+                html.append(HtmlEscape.escapeHtml4(errorMessage));
             }
         }
     }
 
     private void renderBluetoothMacChannel(Connection connection, Device device, StringBuilder html) {
-        html.append("<h2>").append(StringEscapeUtils.escapeHtml("Channel " + CHANNEL_BLUETOOTH_MAC)).append("</h2>");
+        html.append("<h2>").append(HtmlEscape.escapeHtml4("Channel " + CHANNEL_BLUETOOTH_MAC)).append("</h2>");
         JsonBluetoothStates bluetoothStates = connection.getBluetoothConnectionStates();
         if (bluetoothStates == null) {
             return;
@@ -615,14 +613,14 @@ private void renderBluetoothMacChannel(Connection connection, Device device, Str
                     html.append("<table><tr><th align='left'>Name</th><th align='left'>Value</th></tr>");
                     for (PairedDevice pairedDevice : pairedDeviceList) {
                         html.append("<tr><td>");
-                        html.append(StringEscapeUtils.escapeHtml(nullReplacement(pairedDevice.friendlyName)));
+                        html.append(HtmlEscape.escapeHtml4(nullReplacement(pairedDevice.friendlyName)));
                         html.append("</td><td>");
-                        html.append(StringEscapeUtils.escapeHtml(nullReplacement(pairedDevice.address)));
+                        html.append(HtmlEscape.escapeHtml4(nullReplacement(pairedDevice.address)));
                         html.append("</td></tr>");
                     }
                     html.append("</table>");
                 } else {
-                    html.append(StringEscapeUtils.escapeHtml("No bluetooth devices paired"));
+                    html.append(HtmlEscape.escapeHtml4("No bluetooth devices paired"));
                 }
             }
         }
@@ -712,7 +710,7 @@ private void returnHtml(Connection connection, HttpServletResponse resp, String
     void returnError(HttpServletResponse resp, @Nullable String errorMessage) {
         try {
             String message = errorMessage != null ? errorMessage : "null";
-            resp.getWriter().write("<html>" + StringEscapeUtils.escapeHtml(message) + "<br><a href='" + servletUrl
+            resp.getWriter().write("<html>" + HtmlEscape.escapeHtml4(message) + "<br><a href='" + servletUrl
                     + "'>Try again</a></html>");
         } catch (IOException e) {
             logger.info("Returning error message failed", e);
diff --git a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/BindingServlet.java b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/BindingServlet.java
index 951bdba98cc36..b8b2725a3534d 100644
--- a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/BindingServlet.java
+++ b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/BindingServlet.java
@@ -24,7 +24,6 @@
 import javax.servlet.http.HttpServletRequest;
 import javax.servlet.http.HttpServletResponse;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.eclipse.jdt.annotation.NonNullByDefault;
 import org.eclipse.jdt.annotation.Nullable;
 import org.openhab.core.thing.Thing;
@@ -32,6 +31,7 @@
 import org.osgi.service.http.NamespaceException;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
+import org.unbescape.html.HtmlEscape;
 
 /**
  * This servlet provides the base navigation page, with hyperlinks for the defined account things
@@ -104,8 +104,8 @@ protected void doGet(@Nullable HttpServletRequest req, @Nullable HttpServletResp
         }
 
         StringBuilder html = new StringBuilder();
-        html.append("<html><head><title>" + StringEscapeUtils.escapeHtml(BINDING_NAME) + "</title><head><body>");
-        html.append("<h1>" + StringEscapeUtils.escapeHtml(BINDING_NAME) + "</h1>");
+        html.append("<html><head><title>" + HtmlEscape.escapeHtml4(BINDING_NAME) + "</title><head><body>");
+        html.append("<h1>" + HtmlEscape.escapeHtml4(BINDING_NAME) + "</h1>");
 
         synchronized (accountHandlers) {
             if (accountHandlers.isEmpty()) {
@@ -113,7 +113,7 @@ protected void doGet(@Nullable HttpServletRequest req, @Nullable HttpServletResp
             } else {
                 for (Thing accountHandler : accountHandlers) {
                     String url = URLEncoder.encode(accountHandler.getUID().getId(), "UTF8");
-                    html.append("<a href='./" + url + " '>" + StringEscapeUtils.escapeHtml(accountHandler.getLabel())
+                    html.append("<a href='./" + url + " '>" + HtmlEscape.escapeHtml4(accountHandler.getLabel())
                             + "</a><br>");
                 }
             }
diff --git a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/Connection.java b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/Connection.java
index b3fb362f373fd..5e2d5a2bfc418 100644
--- a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/Connection.java
+++ b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/Connection.java
@@ -1194,7 +1194,6 @@ public void smartHomeCommand(String entityId, String action, @Nullable String pr
                                     .collect(Collectors.joining(" / ")));
                 }
             }
-
         } catch (URISyntaxException e) {
             logger.warn("URL '{}' has invalid format for request '{}': {}", url, requestBody, e.getMessage());
         }
@@ -1223,7 +1222,6 @@ public List<DeviceNotificationState> getDeviceNotificationStates() {
             String json = makeRequestAndReturnString(alexaServer + "/api/device-notification-state");
             JsonDeviceNotificationState result = parseJson(json, JsonDeviceNotificationState.class);
             return Objects.requireNonNullElse(result.deviceNotificationStates, List.of());
-
         } catch (IOException | URISyntaxException | InterruptedException e) {
             logger.info("Error getting device notification states", e);
         }
diff --git a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/channelhandler/ChannelHandlerAnnouncement.java b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/channelhandler/ChannelHandlerAnnouncement.java
index 4dd7204f921b1..5ef1bd941b903 100644
--- a/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/channelhandler/ChannelHandlerAnnouncement.java
+++ b/bundles/org.openhab.binding.amazonechocontrol/src/main/java/org/openhab/binding/amazonechocontrol/internal/channelhandler/ChannelHandlerAnnouncement.java
@@ -16,13 +16,13 @@
 import java.net.URISyntaxException;
 import java.util.Objects;
 
-import org.apache.commons.lang.StringEscapeUtils;
 import org.eclipse.jdt.annotation.NonNullByDefault;
 import org.eclipse.jdt.annotation.Nullable;
 import org.openhab.binding.amazonechocontrol.internal.Connection;
 import org.openhab.binding.amazonechocontrol.internal.jsons.JsonDevices.Device;
 import org.openhab.core.library.types.StringType;
 import org.openhab.core.types.Command;
+import org.unbescape.xml.XmlEscape;
 
 import com.google.gson.Gson;
 import com.google.gson.JsonSyntaxException;
@@ -72,7 +72,7 @@ public boolean tryHandleCommand(Device device, Connection connection, String cha
                             Boolean sound = request.sound;
                             if (sound != null) {
                                 if (!sound && !speak.startsWith("<speak>")) {
-                                    speak = "<speak>" + StringEscapeUtils.escapeXml(speak) + "</speak>";
+                                    speak = "<speak>" + XmlEscape.escapeXml10(speak) + "</speak>";
                                 }
                                 if (sound && speak.startsWith("<speak>")) {
                                     body = "Error: The combination of sound and speak in SSML syntax is not allowed";
@@ -87,8 +87,7 @@ public boolean tryHandleCommand(Device device, Connection connection, String cha
                     } catch (JsonSyntaxException e) {
                         body = "Invalid Json." + e.getLocalizedMessage();
                         title = "Error";
-                        speak = "<speak><lang xml:lang=\"en-US\">" + StringEscapeUtils.escapeXml(body)
-                                + "</lang></speak>";
+                        speak = "<speak><lang xml:lang=\"en-US\">" + XmlEscape.escapeXml10(body) + "</lang></speak>";
                         body = e.getLocalizedMessage();
                     }
                 }