java 防止xss和sql注入

思路 写个过滤器，然后写个自己写个新的XssHttpServletRequestWrapper类继承HttpServletRequestWrapper这个类(ps:这个extends ServletRequestWrapper implements HttpServletRequest)，重写里面的getParameterValues，getParameterMap，getParameter，getHeader方面，重写的目的是在方法里面新增防止xss和sql的cleanXSS（自己编写）方法。

先看下过滤器的代码

package cn.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import cn.tools.XssHttpServletRequestWrapper;
/*
 * 参数拦截器
 * */
public class XssFilter implements Filter {

	public void destroy() {
	}

	public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
		XssHttpServletRequestWrapper xssRequest = new XssHttpServletRequestWrapper((HttpServletRequest)request); 
		chain.doFilter(xssRequest, response);
	}

	public void init(FilterConfig fConfig) throws ServletException {
	}
}

在看下XssHttpServletRequestWrapper类的代码

package cn.tools;

import java.util.HashMap;  
import java.util.Map;  
import javax.servlet.http.HttpServletRequest;  
import javax.servlet.http.HttpServletRequestWrapper;  

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper {  
	public XssHttpServletRequestWrapper(HttpServletRequest request) {  
		super(request);  
	}  
	@Override   
	public String[] getParameterValues(String parameter) {  
		String[] values = super.getParameterValues(parameter);  
		if (values == null) {  
			return null;  
		}  
		int count = values.length;  
		String[] encodedValues = new String[count];  
		for (int i = 0; i < count; i++) {  
			encodedValues[i] = cleanXSS(values[i]);  
		}  
		return encodedValues;  
	}  
	@Override 
	public Map getParameterMap() {  
		Map map = super.getParameterMap();  
		Map encodedMap = new HashMap();  
		encodedMap.putAll(map);  

		for (Map.Entry entry : encodedMap.entrySet()) {  
			String[] value = entry.getValue();  
			String[] encodedValues = new String[value.length];  
			for (int i = 0; i < value.length; i++) {  
				encodedValues[i] = cleanXSS(value[i]);  
			}  
			encodedMap.put(entry.getKey(), encodedValues);  
		}  
		return encodedMap;  
	}  
	@Override 
	public String getParameter(String parameter) {  
		String value = super.getParameter(parameter);  
		if (value == null) {  
			return null;  
		}  
		return cleanXSS(value);  
	}  
	@Override 
	public String getHeader(String name) {  
		String value = super.getHeader(name);  
		if (value == null)  
			return null;  
		return cleanXSS(value);  
	}  
	//关键方法 防止xss
	private String cleanXSS(String value) {  
		value = value.replaceAll("<", "<").replaceAll(">", ">");
		value = value.replaceAll("\\(", "(").replaceAll("\\)", ")");
		value = value.replaceAll("'", "'");
		value = value.replaceAll("_", "_");
		value = value.replaceAll("eval\\((.*)\\)", "");
		value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");
		value = value.replaceAll("script", "");
		return value;
	}  


}  

<!-- xss过滤 -->
	<filter>
		<filter-name>xssfilter</filter-name>
		<filter-class>cn.filter.XssFilter</filter-class>
	</filter>
	<filter-mapping>
		<filter-name>xssfilter</filter-name>
		<url-pattern>*.do</url-pattern>
	</filter-mapping>
	<filter-mapping>
		<filter-name>xssfilter</filter-name>
		<url-pattern>*.jsp></url-pattern>
	</filter-mapping>

最后你在表单post过来的数据如果有特殊字符会被替换掉、