java escapse html_xss ***

添加FILTER

public class XSSFilter implements Filter {

@Override

public void init(FilterConfig filterConfig) throws ServletException {

}

@Override

public void destroy() {

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

chain.doFilter(new X×××equestWrapper((HttpServletRequest) request), response);

}

}增加PARAM的拦截:

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang3.StringEscapeUtils;

public class XssHttpServletRequestWrapper extends HttpServletRequestWrapper{

public XssHttpServletRequestWrapper(HttpServletRequest request) {

super(request);

}

@Override

public String getHeader(String name) {

return StringEscapeUtils.escapeHtml4(super.getHeader(name));

}

@Override

public String getQueryString() {

return StringEscapeUtils.escapeHtml4(super.getQueryString());

}

@Override

public String getParameter(String name) {

return StringEscapeUtils.escapeHtml4(super.getParameter(name));

}

@Override

public String[] getParameterValues(String name) {

String[] values = super.getParameterValues(name);

if(values != null) {

int length = values.length;

String[] escapseValues = new String[length];

for(int i = 0; i 

escapseValues[i] = StringEscapeUtils.escapeHtml4(values[i]);

}

return escapseValues;

}

return super.getParameterValues(name);

}

}