What to escape XSS (JSTL) - jstl

Question

I'm working on a small JSTL project and I want to prevent xss, the first step I want to take is escaping in html.
Is there a rule what I should escape and what not?
For example the following code prints out a form from the databasepoints
<c:forEach var="player" items="${players}" varStatus="counter">
<li>
<label for="<c:out value="${counter.count}"/>" >${player.email}:</label>
<input class="values" id="<c:out value="${counter.count}"/>" type="number" name="<c:out value="${player.id}"/>" ondblclick="fillInInput(this)" autocomplete="off" placeholder="<c:out value="${player.points}"/>">
</li>
</c:forEach>
This prints some error messages:
<c:if test="${errors.size() >0}">
<div id="errors">
<c:forEach var="error" items="${errors}">
<p><c:out value="${error}"/></p>
</c:forEach>
</div>
</c:if>
This prints a list with rewards from the database
<c:forEach var="reward" items="${rewards}">
<tr>
<td><c:out value="${reward.name}"/></td>
</tr>
</c:forEach>
This prints a checkbox list with rewardtypes which the user can choose from:
<c:forEach var="reward" items="${rewards}" varStatus="counter">
<li><input id="<c:out value="${counter.count + 100}"/>" class="rewards" type="checkbox" onchange="checkButton('button2','rewards')" name="rewardType" value="<c:out value="${reward}"/>" checked>
<label for="<c:out value="${counter.count + 100}"/>"><c:out value="${reward}"/></label></li>
</c:forEach>
Right now I've simply escaped everything,but it doesn't feel right. Can anyone tell me if there is some rule or something so I know what I should escape and what not?
Thanks in advance.