过滤特殊字符

记录：非法字符过滤 servletFilter,用户session验证servletFilter2010-02-03 11:19servletFilter 是非常强大的。

能过滤 页面提交过来的所有参数的内容，，例如用户可能会在表单中加入<script><script>这种字符，后果可是恐怖的。

现在发布一个非法字符转义的filter

JAVA CODE:

package com.jcxsw.filter;

import java.io.IOException;


import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class IllegalCharacterFilter implements Filter {

private static final long serialVersionUID = -5916500037685553487L;


public void destroy() {
// TODO Auto-generated method stub

}

@SuppressWarnings("unchecked")
public void doFilter(ServletRequest request, ServletResponse response,
FilterChain arg2) throws IOException, ServletException {
HttpServletRequest servletrequest = (HttpServletRequest) request;
HttpServletResponse servletresponse = (HttpServletResponse) response;
String param = "";
String paramValue = "";

servletresponse.setContentType("text/html");
servletresponse.setCharacterEncoding("gbk");
servletrequest.setCharacterEncoding("gbk");
java.util.Enumeration params = request.getParameterNames();
while (params.hasMoreElements()) {

param = (String) params.nextElement();
String[] values = servletrequest.getParameterValues(param);//获得每个参数的value

for (int i = 0; i < values.length; i++) {

paramValue = values[i];

paramValue = paramValue.replaceAll("<", "&lt");
paramValue = paramValue.replaceAll(">", "&gt");

//这里还可以增加，如领导人 自动转义成****,可以从数据库中读取非法关键字。
values[i] = paramValue;



}

//把转义后的参数重新放回request中
request.setAttribute(param, paramValue);
}
//继续向下

arg2.doFilter(request, response);

}

public void init(FilterConfig arg0) throws ServletException {
// 初始化

}

}

web.xml code

<!-- 过滤非法字符 -->
<filter>
<filter-name>IllegalCharacterFilter</filter-name>
<filter-class>
com.jcxsw.filter.IllegalCharacterFilter
</filter-class>
</filter>
<filter-mapping>
<filter-name>IllegalCharacterFilter</filter-name>
<url-pattern>/*</url-pattern> <!--这种配置，可能连图片都会被过滤在内，它不支持不等于，与正则，不过可以在初始化中自己定义正则，通过filter来解析，把不符合的pass掉-->
</filter-mapping>

再发布一个验证session的filter

JAVA CODE:

package com.jcxsw.filter;

import java.io.IOException;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.jcxsw.member.vo.MemberUser;

public class MemberAuthorityFilter implements Filter {

public void destroy() {
// TODO Auto-generated method stub

}

public void doFilter(ServletRequest request, ServletResponse response,
FilterChain chain) throws IOException, ServletException {
// TODO Auto-generated method stub
HttpServletRequest httpReq = (HttpServletRequest) request;
HttpServletResponse httpRes = (HttpServletResponse) response;
if (request instanceof HttpServletRequest) {
MemberUser memberUser = (MemberUser)httpReq.getSession()
.getAttribute("memberUser");

if(memberUser == null){
httpRes.sendRedirect(httpReq.getContextPath()+"/member-user/login");
return;
}

}
chain.doFilter(request, response);

}

public void init(FilterConfig filterConfig) throws ServletException {
// TODO Auto-generated method stub

}

}
web.xml CODE

<filter-name>MemberAuthorityFilter</filter-name>
<filter-class>
com.jcxsw.filter.MemberAuthorityFilter
</filter-class>
</filter>
<filter-mapping>
<filter-name>MemberAuthorityFilter</filter-name>
<url-pattern>/my/*</url-pattern><!--验证所有my目录下的-->
</filter-mapping>