<dependency>
<groupId>commons-validator</groupId>
<artifactId>commons-validator</artifactId>
<version>1.4.0</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
<artifactId>hibernate-validator</artifactId>
<version>4.3.1.Final</version>
</dependency>
在pom.xml中添加上面两个依赖
自定义注解如下
import static java.lang.annotation.ElementType.*;
import static java.lang.annotation.RetentionPolicy.*;
import java.lang.annotation.Documented;
import java.lang.annotation.Retention;
import java.lang.annotation.Target;
import javax.validation.Constraint;
import javax.validation.Payload;
//参考资源:http://www.coolfancy.com/log/47.html ,
//参考资源:http://www.oschina.net/code/snippet_811941_14131
//参考资源: http://www.xfocus.net/articles/200508/816.html
//参考资源:http://www.symantec.com/connect/articles/detection-sql-injection-and-cross-site-scripting-attacks
@Target( { METHOD, FIELD, ANNOTATION_TYPE })
@Retention(RUNTIME)
@Constraint(validatedBy = CheckSqlInjectionValidator.class)
@Documented
public @interface CheckSqlInjection {
String message() default "{SQL注入验证未通过}";
Class<?>[] groups() default {};
Class<? extends Payload>[] payload() default {};
}
import javax.validation.ConstraintValidator;
import javax.validation.ConstraintValidatorContext;
public class CheckSqlInjectionValidator implements ConstraintValidator<CheckSqlInjection, String> {
public void initialize(CheckSqlInjection constraintAnnotation) {
}
public boolean isValid(String object, ConstraintValidatorContext constraintContext) {
if (object == null) {
return true;
} else {
return this.sqlValidate(object);
}
}
// 效验
protected boolean sqlValidate(String str) {
// 统一转为小写
str = str.toLowerCase();
// 过滤掉的sql关键字,可以手动添加
String badStr = "'exec |execute |insert |select |delete |update |count |drop |chr |mid |master |truncate |"
+ "char |declare |sitename |net user |xp_cmdshell |like'|create |"
+ "table |from |grant |use |group_concat |column_name |"
+ "information_schema.columns|table_schema|union |where |order |by |"
+ "like ";
String[] badStrs = badStr.split("\\|");
for (int i = 0; i < badStrs.length; i++) {
if (str.indexOf(badStrs[i]) >= 0) {
System.err.println("sql注入验证未通过:" + str);
return false;
}
}
return true;
}
}