使用Servlet Filter来防止SQL注入的方法
参考:[url]http://618119.com/archives/2010/02/23/156.html[/url]
参考:[url]http://618119.com/archives/2010/02/23/156.html[/url]
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
public class ReqFilter implements Filter {
public void init(FilterConfig config) throws ServletException {
}
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
ReqHttpServletRequestWrapper reqRequest = new ReqHttpServletRequestWrapper(
(HttpServletRequest) request);
chain.doFilter(reqRequest, response);
}
public void destroy() {
}
}
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;
public class ReqHttpServletRequestWrapper extends HttpServletRequestWrapper {
HttpServletRequest orgRequest = null;
public ReqHttpServletRequestWrapper(HttpServletRequest request) {
super(request);
orgRequest = request;
}
/**
* 覆盖getParameter方法,将参数名和参数值都做req过滤。<br/>
* 如果需要获得原始的值,则通过super.getParameterValues(name)来获取<br/>
* getParameterNames,getParameterValues和getParameterMap也可能需要覆盖
*/
@Override
public String getParameter(String name) {
String value = super.getParameter(name);
if (value != null) {
value = reqEncode(value);
}
return value;
}
/**
* 覆盖getHeader方法,将参数名和参数值都做req过滤。<br/>
* 如果需要获得原始的值,则通过super.getHeaders(name)来获取<br/> getHeaderNames 也可能需要覆盖
*/
/* @Override
public String getHeader(String name) {
String value = super.getHeader(reqEncode(name));
if (value != null) {
value = reqEncode(value);
}
return value;
}*/
/**
* 将容易引起req漏洞的半角字符直接替换成全角字符
*
* @param s
* @return
*/
private static String reqEncode(String s) {
if (s == null || "".equals(s)) {
return s;
}
StringBuilder sb = new StringBuilder(s.length() + 16);
for (int i = 0; i < s.length(); i++) {
char c = s.charAt(i);
switch (c) {
case '\'':
sb.append("′");// ´");
break;
case '′':
sb.append("′");// ´");
break;
case '\"':
sb.append(""");
break;
case '"':
sb.append(""");
break;
case '&':
sb.append("&");
break;
case '#':
sb.append("#");
break;
case '\\':
sb.append('¥');
break;
default:
sb.append(c);
break;
}
}
return sb.toString();
}
/**
* 获取最原始的request
*
* @return
*/
public HttpServletRequest getOrgRequest() {
return orgRequest;
}
/**
* 获取最原始的request的静态方法
*
* @return
*/
public static HttpServletRequest getOrgRequest(HttpServletRequest req) {
if (req instanceof ReqHttpServletRequestWrapper) {
return ((ReqHttpServletRequestWrapper) req).getOrgRequest();
}
return req;
}
}
<filter>
<display-name>reqFilter</display-name>
<filter-name>reqFilter</filter-name>
<filter-class>jp.co.bsnw.servlet.ReqFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>reqFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>