使getParameter方法具有防SQL注入的功能

定义包装器对request进行包装，修改其内的getParameter方法,

使getParameter方法具有防SQL注入的功能


一、定义一个防SQL注入的类，目的在于转换一些特殊符号

public class SQLSafe{

public static String tran(String words){

if(words!=null){

if(words.indexOf("%0d%0a")>=0)

{

words = words.replace("%0d%0a", "");

}

StringBuffer stringbuffer = new StringBuffer();

int j = words.length();

for(int i = 0; i < j; i++)

{

char c = words.charAt(i);

switch(c)

{

case 60: stringbuffer.append("<"); break;

case 62: stringbuffer.append(">"); break;

case 39: stringbuffer.append("'");break;

case 34: stringbuffer.append("""); break;

case 169: stringbuffer.append("©"); break;

case 174: stringbuffer.append("®"); break;

case 165: stringbuffer.append("¥"); break;

case 8364: stringbuffer.append("€"); break;

case 8482: stringbuffer.append("™"); break;

case 13:

if(i < j - 1 && words.charAt(i + 1) == 10)

{stringbuffer.append("<br>");

i++;

}

break;

case 32:

if(i < j - 1 && words.charAt(i + 1) == ' ')

{

stringbuffer.append("  ");

i++;

break;

}

default:

stringbuffer.append(c);

break;

}

}

return new String(stringbuffer.toString());

}else{

return words;

}

}
public static String unTran(String words){

String result = "";

String strTo ="'";

int intFromLen = strTo.length();

int intPos = 0;

if(words==null||"".equals(words)){

return words;

}

while((intPos=words.indexOf("＇"))!=-1){

result = result + words.substring(0,intPos);

result = result + strTo;

words = words.substring(intPos+intFromLen);

}

result = result + words;

return result;

}



public static boolean checkSql(String words,String[] sqls){

if(words==null||"".equalsIgnoreCase(words.trim()))

return false;

words = words.toLowerCase();



for(String s:sqls){



if(words.indexOf(s)!=-1&&s.length()==1&&s.indexOf("'")==-1)

return true;

if(words.indexOf(" "+s+" ")!=-1&&s.length()>1&&s.indexOf("'")==-1)

return true;

}

return false;

}

}
二、定义一个包装器类


import java.util.*;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;


public class ParameterRequestWrapper extends HttpServletRequestWrapper {

private Map params;

public ParameterRequestWrapper(HttpServletRequest request) {

super(request);

this.params=request.getParameterMap();;

}

public Map getParameterMap() {

return params;

}

public Enumeration getParameterNames() {

Vector l=new Vector(params.keySet());

return l.elements();

}

public String[] getParameterValues(String name) {

Object v = params.get(name);

if(v==null){

return null;

}else if(v instanceof String[]){

return (String[]) v;

}else if(v instanceof String){

return new String[]{(String) v};

}else{

return new String[]{v.toString()};

}

}

public String getParameter(String name) {

Object v = params.get(name);

if(v==null){

return null;

}else if(v instanceof String[]){

String []strArr=(String[]) v;

if(strArr.length>0){

return SQLSafe.tran(strArr[0]); //对经过getParameter的返回值进行防SQL注入

}else{

return null;

}

}else if(v instanceof String){

return SQLSafe.tran((String) v);

}else{

return v.toString();

}

}

}

第三、通过过滤器对request进行包装

ParameterRequestWrapper prw = new ParameterRequestWrapper((HttpServletRequest)request);//定义包装器对request进行包装

FChain.doFilter(prw, response);


这样就实现了对所有的request.getParameter()进行包装，令通过其传入的参数都经过SQLSafe的转码。达到防止直接在页面编辑区输入SQL代码而造成的SQL注入。