java防脚本注入攻击_java防止xss脚本注入攻击，采用spring工具类方式

package com.hs.servlet;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

import org.apache.commons.lang.StringEscapeUtils;

/**

*

* @date 上午9:44:40

* @author DuChaoWei

* @descripte

*/

public class XSSRequestWrapper extends HttpServletRequestWrapper {

/**

* 构造方法

*

* @param request

*/

public XSSRequestWrapper(HttpServletRequest request) {

super(request);

}

/**

* 处理参数值

*/

@Override

public String[] getParameterValues(String parameter) {

String[] values = super.getParameterValues(parameter);

if (values == null) {

return null;

}

int count = values.length;

String[] encodedValues = new String[count];

for (int i = 0; i < count; i++) {

encodedValues[i] = dealString(values[i]);

}

return encodedValues;

}

/**

* 覆盖

*

* @date 上午9:30:43

* @author DuChaoWei

* @descripte

* @param value

* @return

*/

@Override

public String getParameter(String parameter) {

String value = super.getParameter(parameter);

return dealString(value);

}

@Override

public String getHeader(String name) {

String value = super.getHeader(name);

return dealString(value);

}

/**

* 字符串处理

*

* @date 上午9:30:43

* @author DuChaoWei

* @descripte

* @param value

* @return

*/

private String dealString(String value) {

if (value != null) {

// 采用spring的StringEscapeUtils工具类 实现

StringEscapeUtils.escapeHtml(value);

StringEscapeUtils.escapeJavaScript(value);

StringEscapeUtils.escapeSql(value);

}

return value;

}

}

package com.hs.servlet;

import java.io.IOException;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

/**

* 防止xss攻击 过滤器(顺便过滤了 sql攻击)

* @date 上午9:58:58

* @author DuChaoWei

* @descripte

*/

public class XSSFilter implements Filter {

@Override

public void init(FilterConfig arg0) throws ServletException {

}

@Override

public void destroy() {

}

@Override

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)

throws IOException, ServletException {

chain.doFilter(new XSSRequestWrapper((HttpServletRequest) request), response);

}

}