歡迎來到Linux教程網
Linux教程網
Linux教程網
Linux教程網
Linux教程網 >> Linux編程 >> Linux編程 >> Java 防sql注入

Java 防sql注入

日期:2017/3/1 10:55:34   编辑:Linux編程
  1. package com.cssweb.webcall.util;
  2. //: 防止一般SQL注入
  3. // 調用方法:PreventInfusion.sqlInfusion(str);
  4. public class PreventInfusion {
  5. private static final String inj_str = "'@and@exec@insert@select@delete@update@count@*@%@chr@mid@master@truncate@char@declare@;@or@lock table@grant@drop@ascii@-@+@,";
  6. private static String strReplace(String str, String restr) {
  7. return str.replace(restr, "");
  8. }
  9. private static String dealNull(String str) {
  10. String returnstr = null;
  11. if (str == null)
  12. returnstr = "";
  13. else
  14. returnstr = str;
  15. return returnstr;
  16. }
  17. public static String sqlInfusion(String str) {
  18. String inj_stra[] = inj_str.split("@");
  19. str = dealNull(str);
  20. str = str.toLowerCase();
  21. for (int i = 0; i < inj_stra.length; i++) {
  22. if (str.indexOf(inj_stra[i]) >= 0) {
  23. str = strReplace(str, inj_stra[i]);
  24. }
  25. }
  26. return str;
  27. }
  28. public static void main(String[] args) {
  29. System.out.println(sqlInfusion(""));
  30. System.out.println(sqlInfusion("null"));
  31. System.out.println(sqlInfusion(null));
  32. System.out.println(sqlInfusion("'adm'in,SELEct;"));
  33. }
  34. }///:~
Copyright © Linux教程網 All Rights Reserved