Java防止SQL注入的几个途径
<p>java防SQL注入,最简单的办法是杜绝SQL拼接,SQL注入攻击能得逞是因为在原有SQL语句中加入了新的逻辑，如果使用PreparedStatement来代替Statement来执行SQL语句，其后只是输入参数，SQL注入攻击手段将无效，这是因为PreparedStatement不允许在不同的插入时间改变查询的逻辑结构 ,大部分的SQL注入已经挡住了, 在WEB层我们可以过滤用户的输入来防止SQL注入比如用Filter来过滤全局的表单参数 <br />01 import java.io.IOException; <br />02 import java.util.Iterator; <br />03 import javax.servlet.Filter; <br />04 import javax.servlet.FilterChain; <br />05 import javax.servlet.FilterConfig; <br />06 import javax.servlet.ServletException; <br />07 import javax.servlet.ServletRequest; <br />08 import javax.servlet.ServletResponse; <br />09 import javax.servlet.http.HttpServletRequest; <br />10 import javax.servlet.http.HttpServletResponse; <br />11 /**<br />12 * 通过Filter过滤器来防SQL注入攻击<br />13 * </p><p>14 */ <br />15 public class SQLFilter implements Filter { <br />16 private String inj_str = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|; |or|-|+|,"; <br />17 protected FilterConfig filterConfig = null; <br />18 /**<br />19 * Should a character encoding specified by the client be ignored?<br />20 */ <br />21 protected boolean ignore = true; <br />22 public void init(FilterConfig config) throws ServletException { <br />23 this.filterConfig = config; <br />24 this.inj_str = filterConfig.getInitParameter("keywords"); <br />25 } <br />26 public void doFilter(ServletRequest request, ServletResponse response, <br />27 FilterChain chain) throws IOException, ServletException { <br />28 HttpServletRequest req = (HttpServletRequest)request; <br />29 HttpServletResponse res = (HttpServletResponse)response; <br />30 Iterator values = req.getParameterMap().values().iterator();//获取所有的表单参数 <br />31 while(values.hasNext()){ <br />32 String[] value = (String[])values.next(); <br />33 for(int i = 0;i < value.length;i++){ <br />34 if(sql_inj(value)){ <br />35 //TODO这里发现sql注入代码的业务逻辑代码 <br />36 return; <br />37 } <br />38 } <br />39 } <br />40 chain.doFilter(request, response); <br />41 } <br />42 public boolean sql_inj(String str) <br />43 { <br />44 String[] inj_stra=inj_str.split("\\|"); <br />45 for (int i=0 ; i < inj_stra.length ; i++ ) <br />46 { <br />47 if (str.indexOf(" "+inj_stra+" ")>=0) <br />48 { <br />49 return true; <br />50 } <br />51 } <br />52 return false; <br />53 } <br />54 } <br /> <br />也可以单独在需要防范SQL注入的JavaBean的字段上过滤： <br />1 /**<br />2 * 防止sql注入<br />3 *<br />4 * @param sql<br />5 * @return<br />6 */ <br />7 public static String TransactSQLInjection(String sql) { <br />8 return sql.replaceAll(".*([';]+|(--)+).*", " "); <br />9 } <br /></p>
頁:
[1]