Java防止SQL注入的几个途径
转载：http://www.51testing.com/html/03/n-805503.html
Java防SQL注入，最简单的办法是杜绝SQL拼接，SQL注入攻击能得逞是因为在原有SQL语句中加入了新的逻辑，如果使用PreparedStatement来代替Statement来执行SQL语句，其后只是输入参数，SQL注入攻击手段将无效，这是因为PreparedStatement不允许在不同的插入时间改变查询的逻辑结构，大部分的SQL注入已经挡住了，在WEB层我们可以过滤用户的输入来防止SQL注入比如用Filter来过滤全局的表单参数。
?
| import?java.io.IOException; ?import?java.util.Iterator; ?import?javax.servlet.Filter; ?import?javax.servlet.FilterChain; ?import?javax.servlet.FilterConfig; ?import?javax.servlet.ServletException; ?import?javax.servlet.ServletRequest; ?import?javax.servlet.ServletResponse; ?import?javax.servlet.http.HttpServletRequest; ?import?javax.servlet.http.HttpServletResponse; ?????public?class?SQLFilter?implements?Filter?{ ?private?String?inj_str?=?"'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;?|or|-|+|,"; ?protected?FilterConfig?filterConfig?=?null; ????protected?boolean?ignore?=?true; ?public?void?init(FilterConfig?config)?throws?ServletException?{ ?this.filterConfig?=?config; ?this.inj_str?=?filterConfig.getInitParameter("keywords"); ?} ?public?void?doFilter(ServletRequest?request,?ServletResponse?response, ?FilterChain?chain)?throws?IOException,?ServletException?{ ?HttpServletRequest?req?=?(HttpServletRequest)request; ?HttpServletResponse?res?=?(HttpServletResponse)response; ?Iterator?values?=?req.getParameterMap().values().iterator();?while(values.hasNext()){ ?String[]?value?=?(String[])values.next(); ?for(int?i?=?0;i?<?value.length;i++){ ?if(sql_inj(value[i])){ ??return; ?} ?} ?} ?chain.doFilter(request,?response); ?} ?public?boolean?sql_inj(String?str) ?{ ?String[]?inj_stra=inj_str.split("\\|"); ?for?(int?i=0?;?i?<?inj_stra.length?;?i++?) ?{ ?if?(str.indexOf("?"+inj_stra[i]+"?")>=0) ?{ ?return?true; ?} ?} ?return?false; ?} ?} |
?
也可以单独在需要防范SQL注入的JavaBean的字段上过滤：
?
| ??????public?static?String?TransactSQLInjection(String?sql)?{ ?return?sql.replaceAll(".*([';]+|(--)+).*",?"?"); ?} |