1.escapeSql 提供sql转移功能,防止sql注入攻击,例如典型的万能密码攻击' ' or 1=1 ' '
StringBuffer sql = new StringBuffer("select key_sn,remark,create_date from tb_selogon_key where 1=1 ");
if(!CommUtil.isEmpty(keyWord)){
sql.append(" and like '%" + StringEscapeUtils.escapeSql(keyWord) + "%'");
}
2.escapeHtml /unescapeHtml 转义/反转义html脚本
System.out.println(StringEscapeUtils.escapeHtml("dddd"));
输出结果为:<a>dddd</a>
System.out.println(StringEscapeUtils.unescapeHtml("<a>dddd</a>"));
输出为:ddd
3.escapeJavascript/unescapeJavascript 转义/反转义js脚本
System.out.println(StringEscapeUtils.escapeJavaScript("
"));
输出为:<script>alert('111')</script>
4.escapeJava/unescapeJava 把字符串转为unicode编码
System.out.println(StringEscapeUtils.escapeJava("中国"));
输出为:用escapeJava方法转义之后的字符串为:/u4E2D/u56FD/u5171/u4EA7/u515A