统一处理用户提交的参数，防XSS攻击与SQL注入

package com.sf.membs.context;  
  
import java.util.HashMap;
import java.util.Map;
import java.util.Map.Entry;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.log4j.Logger;

import com.sf.membs.config.LogAppender;
import com.sf.membs.util.XSSUtil;
  
public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
    HttpServletRequest orgRequest = null;  
  

	Logger log = Logger.getLogger(LogAppender.CONTENT);
    public XssHttpServletRequestWrapper(HttpServletRequest request) {  
        super(request);  
        orgRequest = request;  
    }  
  
    /** 
     * 覆盖getParameter方法，将参数名和参数值都做xss过滤。<br/> 
     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取<br/> 
     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖 
     */  
    @Override  
    public String getParameter(String name) {
    	//log.info(orgRequest.getRequestURI()+"------getParameter");
        String value = super.getParameter(XSSUtil.xssEncode(name));
    	//log.info("before;【name："+name+";value:"+value+"】");  
        if (value != null) {  
            value = XSSUtil.xssEncode(value);  
        }  
    	//log.info("after:"+value);
    	//log.info("end------getParameter");
        return value;  
    } 


    /*@SuppressWarnings("unchecked")
	@Override 
	public Map<String, Object> getParameterMap() {
    	Map<String, String[]> paramsMap = super.getParameterMap();
		Map<String, Object> value = new HashMap<String, Object>();
		for (Entry<String, String[]> entry : paramsMap.entrySet()) {
			value.put(entry.getKey(), XSSUtil.xssEncode(entry.getValue()[0]));
		}
		return value;
	}*/
    
    @SuppressWarnings("unchecked")
	@Override 
	public Map<String, String[]> getParameterMap() {
    	//log.info(orgRequest.getRequestURI()+"------getParameterMap");
    	Map<String, String[]> paramsMap = super.getParameterMap();
		Map<String, String[]> value = new HashMap<String, String[]>();
    	//log.info("before;【value:"+ToStringBuilder.reflectionToString(value)+"】");  
		for (Entry<String, String[]> entry : paramsMap.entrySet()) {
			int size = entry.getValue().length;
			String[] temp = new String[size];
			
			for(int i=0;i<size;i++){
				String s = entry.getValue()[i];
				temp[i]=XSSUtil.xssEncode(s);
			}
			value.put(entry.getKey(), temp);
		}
    	//log.info("after:"+ ToStringBuilder.reflectionToString(value));
    	//log.info("end------getParameterMap");
		return value;
	}


    @Override 
	public String[] getParameterValues(String name) {
    	//log.info(orgRequest.getRequestURI()+"------getParameterValues");
        String[] value = super.getParameterValues(XSSUtil.xssEncode(name));  
    	//log.info("before;【name："+name+";value:"+ToStringBuilder.reflectionToString(value)+"】");  
        if(value!=null && value.length>0){
        	for(int i=0;i<value.length;i++){
        		value[i]=XSSUtil.xssEncode(value[i]);
        	}
        }
    	//log.info("after:"+ ToStringBuilder.reflectionToString(value));
    	//log.info("end------getParameterValues");
		return value;
	}
    
    /** 
     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。<br/> 
     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取<br/> 
     * getHeaderNames 也可能需要覆盖 
     */  
    @Override  
    public String getHeader(String name) {  
  
    	//log.info(orgRequest.getRequestURI()+"------getHeader");
        String value = super.getHeader(XSSUtil.xssEncode(name));  
        //log.info("before;【name："+name+";value:"+value+"】"); 
        if (value != null) {  
            value = XSSUtil.xssEncode(value);  
            value = value.replaceAll("%3", "%EF%BC%9");
        }  
       // log.info("after:"+ value);
    	//log.info("end------getHeader");
        return value;  
    }  
  
    
  
    /** 
     * 获取最原始的request 
     *  
     * @return 
     */  
    public HttpServletRequest getOrgRequest() {  
        return orgRequest;  
    }  
  
    /** 
     * 获取最原始的request的静态方法 
     *  
     * @return 
     */  
    public static HttpServletRequest getOrgRequest(HttpServletRequest req) {  
        if (req instanceof XssHttpServletRequestWrapper) {  
            return ((XssHttpServletRequestWrapper) req).getOrgRequest();  
        }  
  
        return req;  
    }  
}  

－－－－－－－－－－－－－拦截器写法－－－－－－－－－－－－－－－

package com.sf.membs.context;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

public class XSSFilter implements Filter {
	@Override  
    public void init(FilterConfig filterConfig) throws ServletException {  
    }  
  
    @Override  
    public void doFilter(ServletRequest request, ServletResponse response,  
            FilterChain chain) throws IOException, ServletException {  
  
        XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper(  
                (HttpServletRequest) request);
        chain.doFilter(xssRequest, response);  
    }  
  
    @Override  
    public void destroy() {  
    }
}