Java防止SQL注入的途径介绍

为了防止SQL注入&＃xff0c;最简洁的办法是杜绝SQL拼接&＃xff0c;SQL注入攻击能得逞是因为在原有SQL语句中加入了新的逻辑&＃xff0c;如果使用PreparedStatement来代替Statement来执行SQL语句&＃xff0c;其后只是输入参数&＃xff0c;SQL注入攻击手段将无效&＃xff0c;这是因为PreparedStatement不允许在不同的插入时间改变查询的逻辑结构&＃xff0c;大部分的SQL注入已经挡住了&＃xff0c;在WEB层我们可以过滤用户的输入来防止SQL注入比如用Filter来过滤全局的表单参数。

import java.io.IOException;

import java.util.Iterator;

import javax.servlet.Filter;

import javax.servlet.FilterChain;

import javax.servlet.FilterConfig;

import javax.servlet.ServletException;

import javax.servlet.ServletRequest;

import javax.servlet.ServletResponse;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletResponse;

/**

* 通过Filter过滤器来防SQL注入攻击

*

*/

public class SQLFilter implements Filter {

private String inj_str &＃61; “‘|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|; |or|-|&＃43;|,”;

protected FilterConfig filterConfig &＃61; null;/**

* Should a character encoding specified by the client be ignored?

*/

protected boolean ignore &＃61; true;

public void init&＃xff08;FilterConfig config&＃xff09; throws ServletException {

this.filterConfig &＃61; config;

this.inj_str &＃61; filterConfig.getInitParameter&＃xff08;“keywords”&＃xff09;&＃xff1b;

}

public void doFilter&＃xff08;ServletRequest request, ServletResponse response,

FilterChain chain&＃xff09; throws IOException, ServletException {

HttpServletRequest req &＃61; &＃xff08;HttpServletRequest&＃xff09;request;

HttpServletResponse res &＃61; &＃xff08;HttpServletResponse&＃xff09;response;

Iterator values &＃61; req.getParameterMap&＃xff08;&＃xff09;。values&＃xff08;&＃xff09;。iterator&＃xff08;&＃xff09;&＃xff1b;//获取所有的表单参数

while&＃xff08;values.hasNext&＃xff08;&＃xff09;&＃xff09;{

String[] value &＃61; &＃xff08;String[]&＃xff09;values.next&＃xff08;&＃xff09;&＃xff1b;

for&＃xff08;int i &＃61; 0;i
if&＃xff08;sql_inj&＃xff08;value&＃xff09;&＃xff09;{

//TODO这里发现sql注入代码的业务逻辑代码

Return;}}}

chain.doFilter&＃xff08;request, response&＃xff09;&＃xff1b;}

public boolean sql_inj&＃xff08;String str&＃xff09;

{String[] inj_stra&＃61;inj_str.split&＃xff08;“\\|”&＃xff09;&＃xff1b;

for &＃xff08;int i&＃61;0 ; i
{if &＃xff08;str.indexOf&＃xff08;“ ”&＃43;inj_stra&＃43;“ ”&＃xff09;>&＃61;0&＃xff09;

{return true;}}

return false;}}

也可以单独在需要防范SQL注入的JavaBean的字段上过滤&＃xff1a;

/**

* 防止sql注入

*

* &＃64;param sql

* &＃64;return

*/

public static String TransactSQLInjection&＃xff08;String sql&＃xff09; {

return sql.replaceAll&＃xff08;“.*&＃xff08;[&＃39;;]&＃43;|&＃xff08;--&＃xff09;&＃43;&＃xff09;。*”, “ ”&＃xff09;&＃xff1b;}