java sql 注入 过滤 第三方包_java--仿sql注入--sql过滤器
/**
* SQL过滤
*
* @author zhugl
* @email Abracadabra@gmail.com
* @date 2018-04-20 15:38
*/
public class SQLFilter {
/**
* SQL注入过滤
*
* @param str 待验证的字符串
*/
public static String sqlInject(String str) {
if (StringUtils.isBlank(str)) {
return null;
}
//去掉|"|;|字符
str = StringUtils.replace(str, "", "");
str = StringUtils.replace(str, """, "");
str = StringUtils.replace(str, ";", "");
str = StringUtils.replace(str, "\", "");
//转换成小写
str = str.toLowerCase();
//非法字符
String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alert", "drop"};
//判断是否包含非法字符
for (String keyword : keywords) {
if (str.indexOf(keyword) != -1) {
throw new RRException("包含非法字符");
}
}
return str;
}
}
/** * SQL过滤 * * @author zhugl * @email Abracadabra@gmail.com * @date 2018-04-20 15:38 */ public class SQLFilter { /** * SQL注入过滤 * * @param str 待验证的字符串 */ public static String sqlInject(String str) { if (StringUtils.isBlank(str)) { return null; } //去掉|"|;|字符 str = StringUtils.replace(str, "", ""); str = StringUtils.replace(str, """, ""); str = StringUtils.replace(str, ";", ""); str = StringUtils.replace(str, "\", ""); //转换成小写 str = str.toLowerCase(); //非法字符 String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alert", "drop"}; //判断是否包含非法字符 for (String keyword : keywords) { if (str.indexOf(keyword) != -1) { throw new RRException("包含非法字符"); } } return str; } }