I am looking for a way to stop html injection

Question

If I send the request like <img src = "1"/>, it seems it does not work in this case. I am using owasp policy factory sanitizer.

Can you describe the issue and how can I fix it ?

PolicyFactory policy = new HtmlPolicyBuilder()
    .allowElements("a")
    .allowUrlProtocols("https")
    .allowAttributes("href").onElements("a")
    .requireRelNofollowOnLinks()
    .allowAttributes("src").onElements("img")
    .build();

I am expecting to return an empty string.