java通过包装器防SQL注入

定义包装器对request进行包装，修改其内的getParameter方法,

使getParameter方法具有防SQL注入的功能

一、定义一个防SQL注入的类，目的在于转换一些特殊符号

public class SQLSafe{

    public static String tran(String words){

       if(words!=null){

       if(words.indexOf("%0d%0a")>=0)

       {

           words = words.replace("%0d%0a", "");

       }

       StringBuffer stringbuffer = new StringBuffer();

            int j = words.length();

            for(int i = 0; i < j; i++)

            {

                char c = words.charAt(i);

                switch(c)

                {

                case 60: stringbuffer.append("&lt;"); break;

                case 62: stringbuffer.append("&gt;"); break;

                case 39: stringbuffer.append("&#39;");break;

                case 34: stringbuffer.append("&quot;"); break;

                case 169: stringbuffer.append("&copy;"); break;

                case 174: stringbuffer.append("&reg;"); break;

               case 165: stringbuffer.append("&yen;"); break;

                case 8364: stringbuffer.append("&euro;"); break;

                case 8482: stringbuffer.append("&#153;"); break;

                case 13:

                  if(i < j - 1 && words.charAt(i + 1) == 10)

                  {stringbuffer.append("<br>");

                   i++;

                  }

                  break;

                case 32:

                  if(i < j - 1 && words.charAt(i + 1) == ' ')

                    {

                      stringbuffer.append(" &nbsp;");

                      i++;

                      break;

                    }

                default:

                    stringbuffer.append(c);

                    break;

                }

            }

          return new String(stringbuffer.toString());

       }else{

           return words;

        }

    }
public static String unTran(String words){

       String result = "";

       String strTo ="'";

       int intFromLen = strTo.length();

       int intPos = 0;

       if(words==null||"".equals(words)){

           return words;

       }

       while((intPos=words.indexOf("＇"))!=-1){

           result = result + words.substring(0,intPos);

           result = result + strTo;

           words = words.substring(intPos+intFromLen);

           }

           result = result + words;

       return result;

    }

   

    public static boolean checkSql(String words,String[] sqls){

        if(words==null||"".equalsIgnoreCase(words.trim()))

           return false;

       words = words.toLowerCase();

      

       for(String s:sqls){

          

           if(words.indexOf(s)!=-1&&s.length()==1&&s.indexOf("'")==-1)

              return true;

           if(words.indexOf(" "+s+" ")!=-1&&s.length()>1&&s.indexOf("'")==-1)

              return true;

       }

       return false;

    }

}
二、定义一个包装器类

import java.util.*;

import javax.servlet.http.HttpServletRequest;

import javax.servlet.http.HttpServletRequestWrapper;

public class ParameterRequestWrapper extends HttpServletRequestWrapper {

    private Map params;

    public ParameterRequestWrapper(HttpServletRequest request) {

    super(request);

    this.params=request.getParameterMap();;

    }

    public Map getParameterMap() {

    return params;

    }

    public Enumeration getParameterNames() {

    Vector l=new Vector(params.keySet());

    return l.elements();

    }

    public String[] getParameterValues(String name) {

    Object v = params.get(name);

    if(v==null){

        return null;

    }else if(v instanceof String[]){

        return (String[]) v;

    }else if(v instanceof String){

        return new String[]{(String) v};

    }else{

        return new String[]{v.toString()};

    }

    }

    public String getParameter(String name) {

    Object v = params.get(name);

    if(v==null){

        return null;

    }else if(v instanceof String[]){          

        String []strArr=(String[]) v;

        if(strArr.length>0){

          return SQLSafe.tran(strArr[0]); //对经过getParameter的返回值进行防SQL注入

        }else{

          return null;

        }

    }else if(v instanceof String){

        return SQLSafe.tran((String) v);

    }else{

        return v.toString();

    }

    }   

}

第三、通过过滤器对request进行包装

ParameterRequestWrapper prw = new ParameterRequestWrapper((HttpServletRequest)request);//定义包装器对request进行包装

FChain.doFilter(prw, response);

这样就实现了对所有的request.getParameter()进行包装，令通过其传入的参数都经过SQLSafe的转码。达到防止直接在页面编辑区输入SQL代码而造成的SQL注入。