java 防sql注入(转)

//: 防止一般SQL注入  
//  调用方法：PreventInfusion.sqlInfusion(str);  
public class PreventInfusion {  
    private static final String inj_str = "'@and@exec@insert@select@delete@update@count@*@%@chr@mid@master@truncate@char@declare@;@or@lock table@grant@drop@ascii@-@+@,";  
      
    private static String strReplace(String str, String restr) {  
        return str.replace(restr, "");  
    }  
      
    private static String dealNull(String str) {  
        String returnstr = null;  
        if (str == null)  
            returnstr = "";  
        else 
            returnstr = str;  
        return returnstr;  
    }  
      
    public static String sqlInfusion(String str) {  
        String inj_stra[] = inj_str.split("@");  
        str = dealNull(str);  
        str = str.toLowerCase();  
        for (int i = 0; i < inj_stra.length; i++) {  
            if (str.indexOf(inj_stra[i]) >= 0) {  
                str = strReplace(str, inj_stra[i]);  
            }  
        }  
        return str;  
    }  
      
    public static void main(String[] args) {  
        System.out.println(sqlInfusion(""));  
        System.out.println(sqlInfusion("null"));  
        System.out.println(sqlInfusion(null));  
        System.out.println(sqlInfusion("'adm'in,SELEct;"));  
    }  
}

 

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/183473/viewspace-670871/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/183473/viewspace-670871/