Java 之防止 SQL 注入
2017-09-12 10:38
302 查看
遇到 SQL 直接注入的情况,所以查询了一下解决的办法,在此贴一下代码~~
package com.java.util;
public class filterSQLInjection {
public final static String sqlInjection(String s) {
if (s == null || "".equals(s)) {
return "";
}
try {
s = s.trim().replaceAll("</?[s,S][c,C][r,R][i,I][p,P][t,T]>?", "");//script
s = s.trim().replaceAll("[a,A][l,L][e,E][r,R][t,T]\\(", "").replace("\"", "");// alert
s = s.trim().replace("\\.swf", "").replaceAll("\\.htc", "");
s = s.trim().replace("\\.php\\b", "").replaceAll("\\.asp\\b", "");
s = s.trim().replace("document\\.", "").replaceAll("[e,E][v,V][a,A][l,L]\\(", "");
s = s.trim().replaceAll("'", "").replaceAll(">", "");
s = s.trim().replaceAll("<", "").replaceAll("=", "");
s = s.trim().replaceAll(" [o,O][r,R]", "");
s = s.trim().replaceAll("etc/", "").replaceAll("cat ", "");
s = s.trim().replaceAll("/passwd ", "");
s = s.trim().replaceAll("sleep\\(", "").replaceAll("limit ", "").replaceAll("LIMIT ", "");
s = s.trim().replaceAll("[d,D][e,E][l,L][e,E][t,T][e,E] ", "");// delete
s = s.trim().replaceAll("[s,S][e,E][l,L][e,E][c,C][t,T] ", "");// select;
s = s.trim().replaceAll("[u,U][p,P][d,D][a,A][t,T][e,E] ", "");// update
s = s.trim().replaceAll("[d,D][e,E][l,L][a,A][y,Y] ", "").replaceAll("waitfor ", "");
s = s.trim().replaceAll("print\\(", "").replaceAll("md5\\(", "");
s = s.trim().replaceAll("cookie\\(", "").replaceAll("send\\(", "");
s = s.trim().replaceAll("response\\.", "").replaceAll("write\\(", "")
.replaceAll("&", "");
} catch (Exception e) {
e.printStackTrace();
return "";
}
return s;
}
}
到此结束啦~~
package com.java.util;
public class filterSQLInjection {
public final static String sqlInjection(String s) {
if (s == null || "".equals(s)) {
return "";
}
try {
s = s.trim().replaceAll("</?[s,S][c,C][r,R][i,I][p,P][t,T]>?", "");//script
s = s.trim().replaceAll("[a,A][l,L][e,E][r,R][t,T]\\(", "").replace("\"", "");// alert
s = s.trim().replace("\\.swf", "").replaceAll("\\.htc", "");
s = s.trim().replace("\\.php\\b", "").replaceAll("\\.asp\\b", "");
s = s.trim().replace("document\\.", "").replaceAll("[e,E][v,V][a,A][l,L]\\(", "");
s = s.trim().replaceAll("'", "").replaceAll(">", "");
s = s.trim().replaceAll("<", "").replaceAll("=", "");
s = s.trim().replaceAll(" [o,O][r,R]", "");
s = s.trim().replaceAll("etc/", "").replaceAll("cat ", "");
s = s.trim().replaceAll("/passwd ", "");
s = s.trim().replaceAll("sleep\\(", "").replaceAll("limit ", "").replaceAll("LIMIT ", "");
s = s.trim().replaceAll("[d,D][e,E][l,L][e,E][t,T][e,E] ", "");// delete
s = s.trim().replaceAll("[s,S][e,E][l,L][e,E][c,C][t,T] ", "");// select;
s = s.trim().replaceAll("[u,U][p,P][d,D][a,A][t,T][e,E] ", "");// update
s = s.trim().replaceAll("[d,D][e,E][l,L][a,A][y,Y] ", "").replaceAll("waitfor ", "");
s = s.trim().replaceAll("print\\(", "").replaceAll("md5\\(", "");
s = s.trim().replaceAll("cookie\\(", "").replaceAll("send\\(", "");
s = s.trim().replaceAll("response\\.", "").replaceAll("write\\(", "")
.replaceAll("&", "");
} catch (Exception e) {
e.printStackTrace();
return "";
}
return s;
}
}
到此结束啦~~
相关文章推荐
- Java 防止 SQL 注入工具类
- JavaWeb开发防止SQL、XSS注入
- java 防止SQL注入
- Java防止SQL注入
- 在 Java 中防止 SQL 注入攻击(SQL Injection)的方法
- JavaWeb开发防止SQL、XSS注入
- JavaWeb - JDBC,DriverManager,Connection,Statement,ResultSet,sql的注入和防止
- Java应用中的SQL依赖注入攻击和防范
- Java防止跨站脚本(XSS)注入攻击
- asp.net 如何防止SQL注入
- 防止sql 注入攻击方法
- PHP PDO 防止SQL注入
- 防止SQL注入
- 参数化查询为什么能够防止SQL注入
- mysql防止SQL 注入
- 防止sql语句编写注入攻击
- java防止脚本注入,通过拦截器实现
- sql参数绑定防止注入
- 5.用preparedStatement防止SQL注入
- 实用:防止SQL、XSS等注入攻击的Filter