替换HTML Code

iteye_12884

于 2012-03-20 14:22:27 发布

阅读量119

点赞数

CC 4.0 BY-SA版权

分类专栏： jsp

本文链接：https://blog.youkuaiyun.com/iteye_12884/article/details/82299388

jsp 专栏收录该内容

1 篇文章

订阅专栏

JSP语言可以通过替换输出数据的特殊字符【& < > ” ’ ( )%+-】为其他表示形式后再输出给客户端，例如：


<%
String OutStr = "<script>alert('XSS')</script>";
OutStr = OutStr.replaceAll("&","&");
OutStr = OutStr.replaceAll("<","<");
OutStr = OutStr.replaceAll(">",">");
OutStr = OutStr.replaceAll("\"",""");
OutStr = OutStr.replaceAll("\'","'");
OutStr = OutStr.replaceAll("\\(","(");
OutStr = OutStr.replaceAll("\\)",")");
OutStr = OutStr.replaceAll("%","%");
OutStr = OutStr.replaceAll("\\+","+");
OutStr = OutStr.replaceAll("-","-");
out.println(OutStr);
%>