java sql 注入 过滤 第三方包_java--仿sql注入--sql过滤器

/**

* SQL过滤

*

* @author zhugl

* @email Abracadabra@gmail.com

* @date 2018-04-20 15:38

*/

public class SQLFilter {

/**

* SQL注入过滤

*

* @param str 待验证的字符串

*/

public static String sqlInject(String str) {

if (StringUtils.isBlank(str)) {

return null;

}

//去掉'|"|;|\字符

str = StringUtils.replace(str, "'", "");

str = StringUtils.replace(str, "\"", "");

str = StringUtils.replace(str, ";", "");

str = StringUtils.replace(str, "\\", "");

//转换成小写

str = str.toLowerCase();

//非法字符

String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alert", "drop"};

//判断是否包含非法字符

for (String keyword : keywords) {

if (str.indexOf(keyword) != -1) {

throw new RRException("包含非法字符");

}

}

return str;

}

}