SQL注入过滤器

    1、在web.xml中的配置如下：拦截所有请求---项目中使用并通过了安全扫描

<!--  此方法已经通过扫描，可以上线（sql注入）-->
<filter>  
        <filter-name>AntiSqlInjectionfilter</filter-name>  
        <filter-class>com.sunrise.grid.xss.filter.AntiSqlInjectionfilter</filter-class>  
    </filter>  
    <filter-mapping>  
        <filter-name>AntiSqlInjectionfilter</filter-name>  
        <url-pattern>/*</url-pattern>  
        <dispatcher>REQUEST</dispatcher>  

    </filter-mapping>

    2、具体的SQL过滤器实现类：-----------------------------------------------------------

package com.sunrise.grid.xss.filter;


import java.io.IOException;
import java.util.Enumeration;
import java.util.regex.Pattern;


import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;


public class AntiSqlInjectionfilter implements Filter {
    public void destroy() {
        // TODO Auto-generated method stub
    }


    public void init(FilterConfig arg0) throws ServletException {
        // TODO Auto-generated method stub
    }


    public void doFilter(ServletRequest args0, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {
        HttpServletRequest req = (HttpServletRequest) args0;
        HttpServletResponse res = (HttpServletResponse) response;
        // 获得所有请求参数名
        Enumeration params = req.getParameterNames();
        String sql = "";
        while (params.hasMoreElements()) {
            // 得到参数名
            String name = params.nextElement().toString();
            // System.out.println("name===========================" + name +
            // "--");
            // 得到参数对应值
            String[] value = req.getParameterValues(name);
            for (int i = 0; i < value.length; i++) {
                sql = sql + value[i];
                if (!isValid(value[i])) {// 主要针对参数的值作过滤
                    response.setContentType("text/plain; charset=utf-8");
                    response.getWriter().write("参数包含敏感词汇");
                    return;
                }
            }
        }
        chain.doFilter(args0, response);
    }


    /*
     * // 效验 protected static boolean sqlValidate(String str) { str =
     * str.toLowerCase();// 统一转为小写 String badStr =
     * "'|and|exec|execute|insert|select|delete|update|count|drop|*|%|chr|mid|master|truncate|"
     * +
     * "char|declare|sitename|net user|xp_cmdshell|;|or|-|+|,|like'|and|exec|execute|insert|create|drop|"
     * + "table|from|grant|use|group_concat|column_name|" +
     * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
     * + "chr|mid|master|truncate|char|declare|or|;|--|+|,|like|//|/|%|#";//
     * 过滤掉的sql关键字，可以手动添加
     * 
     * String[] badStrs = badStr.split("\\|"); for (int i = 0; i <
     * badStrs.length; i++) { if (str.indexOf(badStrs[i]) >= 0) { return true; }
     * } return false; }
     */


    // ORACLE 注解 -- /**/
    // 关键字过滤 update ,delete


    static String reg = "(?:')|(?:--)|(/\\*(?:.|[\\n\\r])*?\\*/)|"
            + "(\\b(select|update|and|or|delete|insert|trancate|char|into|substr|ascii|declare|exec|count|master|into|drop|execute)\\b)";


    static Pattern sqlPattern = Pattern.compile(reg, Pattern.CASE_INSENSITIVE);


    /***************************************************************************
     * 参数校验
     * 
     * @param str
     */
    public static boolean isValid(String str) {


        if (sqlPattern.matcher(str).find()) {


            // logger.error("未能通过过滤器：p=" + p);


            return false;
        }
        return true;
    }
}