表单页面由servlet程序生成,servlet为每次产生的表单页面分配一个唯一的随机标识号,并在FORM表单的一个隐藏字段中设置这个标识号,同时在当前用户的Session域中保存这个标识号。
l 当用户提交FORM表单时,负责处理表单提交的serlvet得到表单提交的标识号,并与session中存储的标识号比较,如果相同则处理表单提交,处理完后清除当前用户的Session域中存储的标识号。
l 在下列情况下,服务器程序将拒绝用户提交的表单请求:
l 存储Session域中的表单标识号与表单提交的标识号不同
l 当前用户的Session中不存在表单标识号
l 用户提交的表单数据中没有标识号字段
<!DOCTYPE HTMLPUBLIC "-//W3C//DTDHTML 4.01 Transitional//EN">
<html>
<head>
<title>RepeatForm.html</title>
<meta http-equiv="keywords"content="keyword1,keyword2,keyword3">
<meta http-equiv="description"content="this is my page">
<meta http-equiv="content-type"content="text/html; charset=UTF-8">
<!--<link rel="stylesheet"type="text/css" href="./styles.css">-->
<script type="text/javascript">
var iscommitted= false;
function() checkPost(){
if(!iscommitted){
//docement.getElementById("sub").disabled=true;
iscommitted=true;
returntrue;
}else{
//alert("不能重复提交表单");
returnfalse;
}
}
</script>
</head>
<body>
<form action="./RepeateFormServlet"method="post" οnsubmit="returncheckPost()">
用户名:<input type="text"name="username"/><br/>
<input type="submit"value="提交" id="sub"/>
</form>
</body>
</html>
packagecn.csdn.servlet.form;
importjava.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Random;
import javax.management.RuntimeErrorException;
importsun.misc.BASE64Encoder;
publicclass TokenProcessor {
/*
* 1.把构造方法私有化
* 2.自己创建一个实例
* 3.提供一个方法,让别人能够获取到上面创建的实例对象
*/
private TokenProcessor() {
}
privatestaticfinal TokenProcessor instance = new TokenProcessor();
publicstatic TokenProcessorgetInstace() {
returninstance;
}
public StringgenerateToken() {
int i = new Random().nextInt();
String token= System.currentTimeMillis() + i + "";
try {
MessageDigestmd = MessageDigest.getInstance("md5");
byte[] md5 = md.digest(token.getBytes());
// base64编码的应用
BASE64Encoderencoder = new BASE64Encoder();
return encoder.encode(md5);
}catch (Exception e) {
thrownew RuntimeException(e) ;
}
}
}
packagecn.csdn.servlet.form;
import java.io.IOException;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServlet;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
publicclass FormDealServletextends HttpServlet {
publicvoiddoGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException,IOException {
isTokenValidate(request);
}
privatebooleanisTokenValidate(HttpServletRequest request) {
Stringclient_token = request.getParameter("token");
if(client_token==null){
returnfalse;
}
Stringserver_token = (String)request.getSession().getAttribute("token");
if(server_token==null) returnfalse;
if(!client_token.equals(server_token))returnfalse;
returntrue;
}
publicvoiddoPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException,IOException {
doGet(request,response);
}
}
packagecn.csdn.servlet.form;
import java.io.IOException;
importjavax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
publicclass FormDealServletextends HttpServlet {
publicvoiddoGet(HttpServletRequest request, HttpServletResponse response)
throws ServletException,IOException {
isTokenValidate(request);
}
privatebooleanisTokenValidate(HttpServletRequest request) {
Stringclient_token = request.getParameter("token");
if(client_token==null){
returnfalse;
}
Stringserver_token = (String)request.getSession().getAttribute("token");
if(server_token==null) returnfalse;
if(!client_token.equals(server_token))returnfalse;
returntrue;
}
publicvoid doPost(HttpServletRequestrequest, HttpServletResponse response)
throws ServletException,IOException {
doGet(request,response);
}
}
packagecn.csdn.servlet.form;
importjava.io.IOException;
importjava.io.PrintWriter;
importjavax.servlet.ServletException;
importjavax.servlet.http.HttpServlet;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
publicclass FormGenerateServlet extends HttpServlet {
public void doGet(HttpServletRequestrequest, HttpServletResponse response)
throws ServletException,IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out= response.getWriter();
// 产生表单号
TokenProcessor tp =TokenProcessor.getInstace();
String token = tp.generateToken();
// 放到session中
request.getSession().setAttribute("token",token);
out.print("<formaction='/BookHistory/servlet/FormDealServlet' method='post'>");
out.print("<inputtype='hidden' name='token' value='"+token+"'/>");
out.print("用户名:<input type='text' name='username'/>");
out.print("<inputtype='submit' value='提交'/>");
out.print("</form>");
}
public void doPost(HttpServletRequestrequest, HttpServletResponse response)
throws ServletException,IOException {
doGet(request, response);
}