SQL Injection - make sure you are always using prepared statements and passing in all user values via parameters
XSS - make sure you are escaping user content on submission or on rendering. Struts does provide some protection in their tags. I recall seeing it extended, so I don't know how complete it is.
I have implimented a filter using that I have escaped the user content from the request and I have also used prepared and callable stmts to avoid SQL Injection.
But filters reduces the performance and so just wanted to know how it has been implemented in struts releases where they have taken care of such vulnerabilities. So that I could use a performance based code.
It's not the filter reducing the performance; it's the search/replace. Any solution is going to need to do that. Luckily, it reduces the performance by such a tiny percentage compared to the database call that it's a non-issue.