SQL注入漏洞-Java 解决方法（一）过滤器

这个是常见的漏洞了，相信大家都不会陌生，直接上解决该漏洞的代码 （第二种方法也可以使用AOP）

解决SQL注入漏洞方法（二）使用AOP解决_Zxdwr520的博客-CSDN博客

package com.ifan.soft.filter;

import java.io.IOException;
import java.text.SimpleDateFormat;
import java.util.Date;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import org.apache.log4j.Logger;

/**
 * 关注博主，获取更多解决漏洞的办法
 * @author fan'fan
 *
 */

public class MyFilter implements Filter {
    
    private static SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
    private static final Logger log = Logger.getLogger(MyFilter.class);

/**

*关注博主，获取更多解决漏洞的办法

*/   

 public void doFilter(ServletRequest req, ServletResponse resp, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest)req;
        String url = request.getRequestURI();
        log.info("---当前URL：" + url + "--当前时间" + sdf.format(new Date()));
        String[] strings = {//根据需要来定义
                "from","count","chr","master","truncate","declare","drop","all","all",
                "and","AND","MASTER","COUNT","FROM","DROP","order","to","TO","ALL","alter","ALTER",
                "OR","or","select","DECLARE","EXEC","ORDER","in","IN","on","ON",
                "SELECT","UPDATE","TRUNCATE","exec","GROUP","HAVING","DELETE","like","LIKE",
                "delete","update","insert","group","having","<",">","^","*","\'","!"," ","-","@","$","#",
                "(",")","_","~","`","{","}","[","]","\"","|","？","，","。","《","》","（","）","！",
                "、","——","；","‘","￥","’","【","】","：","&"
                };
            for (String string : strings) {
                String upperCaseURL = url.toUpperCase();
                String upperCaseStr = string.toUpperCase();
                if (upperCaseURL.indexOf(upperCaseStr) >= 0) {
                    request.getRequestDispatcher("/uc/error").forward(req, resp);//如有注入的关键字或字符则去到错误的页面，不在往下执行
                    return ;
                }

//该方法能解决大部分的SQL注入漏洞了，如还需要完整的解决SQL注入漏洞可以关注博主留言
        }
        chain.doFilter(req, resp);
    }
    
    public void init(FilterConfig filterConfig) throws ServletException {
    }
 
    public void destroy() {
    }
}

/**在web.xml中添加*/



<filter>
        <filter-name>MyFilter </filter-name>
        <filter-class>com.ifan.soft.filter.MyFilter </filter-class>
    </filter>

    <filter-mapping>
        <filter-name>MyFilter </filter-name>
        <url-pattern>/*</url-pattern>
    </filter-mapping>