通用防SQL注入函數java版
?public static boolean sql_inj(String str)
?{
????String inj_str = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+|,";
????String inj_stra[] = split(inj_str,"|");
????for (int i=0 ; i < inj_stra.length ; i++ )
????{
????????if (str.indexOf(inj_stra[i])>=0)
????????{
????????????return true;
????????}
????}
????return false;
?}
?jsp中調用該函數檢查是否包函非法字符
?<%
?if(request.getParameter("userID") != null)
????userID = request.getParameter("userID").trim();
??if (StringUtil.sql_inj(userID) || StringUtil.sql_inj(pwd)){
???%>
???<Script Language=javascript>alert('參數中包含非法字符！');history.back(-1);</Script>" ;
???<%
??}else{
? ……
?}%>
?StringUtil 是我的通用防注入函數的包名，該函數參考了ASP通用防SQL注入函數，做了一些修改。