JAVA对特殊字符的处理

最近在维护OA系统的时候，刚好遇到几个类似的问题。总结了一下大概是下面三种情况。

1.在拼接原生SQL的时候，特殊字符如【'】，破坏了SQL的完整性。

public String escapeExprSpecialWord(String keyword) {  
	    if (StringUtils.isNotEmpty(keyword)) {  
	        String[] fbsArr = { "\\","$","(",")","*","+",".","[", "]","?","^","{","}","|","'","%" };  
	        for (String key : fbsArr) {  
	            if (keyword.contains(key)) {  
	                keyword = keyword.replace(key, "\\" + key);  
	            }  
	        }  
	    }  
	    return keyword;  
	}

2.返给前端json数据，com.alibaba.fastjson.JSONObject.toJSONString()，如果内容中包含特殊字符\n,\t,\r等，会导致前端json无法正常解析。

public String formatJsonStr(String str){
		if(StringUtils.isNotEmpty(str)){
			String[] formatStrs = {"\t","\r","\n"};
			for(String key:formatStrs){
				if(str.contains(key)){
					str = str.replace(key, ",");
				}
			}
		}
		return str;
	}

3.文件上传及下载，文件名中有【,】也会导致无法下载，或下载内容为空。

/**
	 * 上传文件
	 * @param files
	 * @return
	 */
	public List<AttachmentEntity> upload(File[] files, String[] fileNames) {
		List<AttachmentEntity> list = new ArrayList<AttachmentEntity>();
		Properties prop = new Properties();
		FileInputStream fis =null;
		InputStream in  = null;
		InputStream propertiesIn  = null;
		FileOutputStream out = null ;
		
		try {
			Resource[] resources = RESOLVER
					.getResources("classpath*:com/**/**/META-INF/upload/*.conf");
			if (resources == null || resources.length < 1) {
				LOGGER.error("上传文件失败，失败原因 ： ", "client.conf不存在！");
				return list;
			} else {

				in = resources[0].getInputStream();
				File file = new File("client.conf");
				out = new FileOutputStream(file);
				byte[] buf = new byte[1024];
				while (true) {
					int r = in.read(buf);
					if (r == -1) {
						break;
					}
					out.write(buf, 0, r);
				}

				ClientGlobal.init(file.getAbsolutePath());
				LOGGER.info("上传中：" + "客户端配置文件初始化完成 ");
				// getting connection of FastDFS
				TrackerClient trackerClient = new TrackerClient();
				TrackerServer trackerServer = trackerClient.getConnection();
				if (trackerServer != null) {
					LOGGER.info("上传中：" + "均衡器初始化成功");
				}
				StorageServer storageServer = null;
				StorageClient storageClient = new StorageClient(trackerServer,
						storageServer);
				propertiesIn = new FileInputStream(file.getAbsolutePath());
				prop.load(propertiesIn);
				String iP = trackerServer.getInetSocketAddress().getHostName();//获取fastdfs IP
				String  ipAndPort = iP+":"+prop.getProperty("http.tracker_server_port");//获取fastdfs 对应下载http uri（ip+端口）
				String fileExtName = "";
				for (int i = 0; i < files.length; i++) {
					
					AttachmentEntity entity = new AttachmentEntity();
					entity.setId(UUIDUtil.generate());
					entity.setAttachmentName(fileNames[i]);//这里fileName中，包含特殊符号，比如逗号，在更新到数据库中没有变化
					entity.setActive("Y");
					entity.setIpAndPort(ipAndPort);//为附件添加http uri；
					if (fileNames[i].contains(".")) {
						fileExtName = fileNames[i].substring(fileNames[i]
								.lastIndexOf(".") + 1);
					} else {
						LOGGER.error("上传文件失败，失败原因 ： ", "文件名非法");
					}
					 fis = new FileInputStream(files[i]);
					byte[] file_buff = null;
					if (fis != null) {
						int len = fis.available();
						file_buff = new byte[len];
						fis.read(file_buff);
					}
					LOGGER.info("file length: " + file_buff.length);
					// meta data setting  fileNameString(fileNames[i])
					NameValuePair[] meta_list = new NameValuePair[3];
					meta_list[0] = new NameValuePair("fileName", fileNameString(fileNames[i]));//这里将fileNameString(fileNames[i])将原来文件名中逗号替换为空格
					meta_list[1] = new NameValuePair("fileExtName", fileExtName);
					meta_list[2] = new NameValuePair("fileLength",
							String.valueOf(files[i].length()));
					String group_name = null;
					// get store storages
					StorageServer[] storageServers = trackerClient
							.getStoreStorages(trackerServer, group_name);
					if (storageServers == null) {
						LOGGER.error("访问存储服务器失败，失败原因 ： ",
								storageClient.getErrorCode());
					} else {
						LOGGER.info("store 数目: " + storageServers.length);
						for (int k = 0; k < storageServers.length; k++) {
							LOGGER.info(k
									+ 1
									+ ". "
									+ storageServers[k].getInetSocketAddress()
											.getAddress().getHostAddress()
									+ ":"
									+ storageServers[k].getInetSocketAddress()
											.getPort());
						}
					}

					long startTime = System.currentTimeMillis();
					// upload files
					String[] results = storageClient.upload_file(file_buff,
							fileExtName, meta_list);
					LOGGER.info("已上传至服务器，用时 ： ",
							(System.currentTimeMillis() - startTime) + " ms");
					if (results == null) {
						LOGGER.error("上传文件 失败，error code: "
								+ storageClient.getErrorCode());
					}

					// // get groupName and remoteFileName
					group_name = results[0];
					String remote_filename = results[1];
					LOGGER.info("group_name: " + group_name
							+ ", remote_filename: " + remote_filename);
					LOGGER.info(storageClient.get_file_info(group_name,
							remote_filename).toString());
					entity.setPosition(group_name + "/" + remote_filename);
					
					// get storage sever of this file
					ServerInfo[] servers = trackerClient.getFetchStorages(
							trackerServer, group_name, remote_filename);
					if (servers == null) {
						LOGGER.error("获取tracker失败, error code: "
								+ trackerClient.getErrorCode());
					} else {
						LOGGER.info("storage 数目: " + servers.length);
						for (int k = 0; k < servers.length; k++) {
							System.err.println(k + 1 + ". "
									+ servers[k].getIpAddr() + ":"
									+ servers[k].getPort());
						}
					}
					attachmentDao.add(entity);
					LOGGER.info("附件信息成功插入数据库");
					list.add(entity);
				
				}
				return list;
			}
		} catch (FileNotFoundException fnfex) {
			LOGGER.error("文件未找到：" + fnfex.getMessage());
			return list;
		} catch (IOException ioe) {
			LOGGER.error("IO错误：" + ioe.getMessage());
			return list;
		} catch (MyException mye) {
			LOGGER.error("FastDFS错误 ：" + mye.getMessage());
			return list;
		} catch (Exception e) {
			LOGGER.error("其他错误 ：" + e.getMessage());
			return list;
		}
		finally{
			try {
				fis.close();
				in.close();
				propertiesIn.close();
				out.close();
			} catch (IOException e) {
				// TODO Auto-generated catch block
				e.printStackTrace();
			}
		}
	}

/**
	 * 文件下载
	 * @param id
	 * @param fileName
	 */
	@Override
	public void download(String id, String fileName) {
		InputStream in= null;
		FileOutputStream out  = null;
		try {
			Resource[] resources = RESOLVER
					.getResources("classpath*:com/**/**/META-INF/upload/*.conf");
			if (resources == null || resources.length < 1) {
				LOGGER.error("下载文件失败，失败原因 ： ", "client.conf不存在！");
			} else {

				 in = resources[0].getInputStream();
				File file = new File("client.conf");
				 out = new FileOutputStream(file);
				byte[] buf = new byte[1024];
				while (true) {
					int r = in.read(buf);
					if (r == -1) {
						break;
					}
					out.write(buf, 0, r);
				}

				LOGGER.info("fileName：" + fileName);
				ClientGlobal.init(file.getAbsolutePath());
				LOGGER.info("下载中：" + "client.conf初始化成功！");
				TrackerClient trackerClient = new TrackerClient();
				TrackerServer trackerServer = trackerClient.getConnection();
				if (trackerServer != null) {
					LOGGER.info("下载中：" + "成功获得均衡器");
				} else {
					LOGGER.error("下载失败：" + "均衡器获取失败");
				}
				StorageServer storageServer = null;

				StorageClient storageClient = new StorageClient(trackerServer,
						storageServer);
				// groupName and remoteFileName should exist
				String group_name = "group1";
				AttachmentEntity aEntity = attachmentDao.queryById(id);
				String remote_filename = aEntity.getPosition();
				String[] paths = remote_filename.split("/");
				FileInfo fi = storageClient.get_file_info(paths[0],
						remote_filename.replace(paths[0] + "/", ""));
				LOGGER.error("下载中..." + "得到文件信息");
				HttpServletResponse response = ResponseContext
						.geRequestContext().getResponse();
				response.reset();
				response.setContentType("application/download;charset=UTF-8");
				// response.setHeader("Content-Disposition","attachment;" +
				// "filename=" + new String(fileName.getBytes("ISO_8859_1"),
				// "UTF-8"));
				// 如果使用上面编码格式,否则附件名称若为中文,则乱码,下载下来的附件名称,显示不全.或者乱乱码 .应该使用下面的编码格式.
				LOGGER.info("fileName(gbk)=[" + new String(fileNameString(fileName).getBytes("gbk"), "ISO8859-1") +"]");
				response.setHeader("Content-Disposition", "attachment;"
						+ "filename="
						+ new String(fileNameString(fileName).getBytes("gbk"), "ISO8859-1"));//无法下载，原因可能是在这里文件名中有逗号，在解析header的时候，逗号导致。这里请求文件名，应该与写入的保持一致
				// String basepath =
				// System.getProperties().getProperty("user.home");
				// String path = basepath + File.separator + new
				// String(fileName.getBytes("GBK"), "ISO_8859_1");
				ServletOutputStream oOutput = response.getOutputStream();
				byte[] inputStream = storageClient.download_file(paths[0],
						remote_filename.replace(paths[0] + "/", ""));
				try {
					oOutput.write(inputStream);
					oOutput.flush();
				} catch (IOException ioe) {
					LOGGER.error("下载失败：" + "写入本地文件失败！");
				} finally {
					IOUtils.close(oOutput);
				}

				String sourceIpAddr = fi.getSourceIpAddr();
				long size = fi.getFileSize();
				LOGGER.info("ip:" + sourceIpAddr + ",size:" + size);
			}
		} catch (FileNotFoundException fnfex) {
			LOGGER.error("下载失败，文件未找到：" + fnfex.getMessage());
		} catch (IOException ioex) {
			LOGGER.error("下载失败，IO 错误 ：" + ioex.getMessage());
		} catch (MyException e) {
			LOGGER.error("下载失败，其他错误 ：" + e.getMessage());
		}
		finally {
			 try {
				 if(in!=null)
				in.close();
				 if(out!=null)
				 out.close(); 
			} catch (IOException e) {
				// TODO Auto-generated catch block
				e.printStackTrace();
			}	
			
		}
	}

public String fileNameString(String fileName){
        if(fileName.contains(",")){
        	fileName = fileName.replace(","," ");
        }
        return fileName;
    }

这三个问题，本质都是特殊字符导致的错误。这里提供后台的处理方式，供大家参考