原理，过滤所有请求中含有非法的字符，例如：, & < select delete 等关键字，黑客可以利用这些字符进行注入攻击，原理是后台实现使用拼接字符串，案例：
某个网站的登入验证的SQL查询代码为
strSQL = "SELECT * FROM users WHERE (name = '" + userName + "') and (pw = '"+ passWord +"');"
恶意填入
userName = "' OR '1'='1";与passWord = "' OR '1'='1";时，将导致原本的SQL字符串被填为
strSQL = "SELECT * FROM users WHERE (name = '' OR '1'='1') and (pw = '' OR '1'='1');"
也就是实际上运行的SQL命令会变成下面这样的
strSQL = "SELECT * FROM users;"
因此达到无帐号密码，亦可登入网站。所以SQL注入攻击被俗称为黑客的填空游戏。
实现三个步骤：
1，编写filter
2，涛涛电脑知识网，配置xml
3，www.xuhantao.com，配置error.jsp
filter代码；
package cn.kepu.filter;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Set;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* 防止sql注入，自定义filter
* cn.kepu.filter.SqlInjectFilter.java
* @author ffr
* created at 2012-7-12
*/
public class SqlInjectFilter implements Filter {
private static List<String> invalidsql = new ArrayList<String>();
private static String error = "/error.jsp";
private static boolean debug = false;
public void destroy() {
}
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain fc) throws IOException, ServletException {
if(debug){
System.out.println("prevent sql inject filter works");
}
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)res;
Map<String, String> params = request.getParameterMap();
Set<String> keys = params.keySet();
for(String key : keys){
String value = request.getParameter(key);
if(debug){
System.out.println("process params <key, value>: <"+key+", "+value+">");
}
for(String word : invalidsql){
if(word.equalsIgnoreCase(value) || value.contains(word)){
if(value.contains("<")){
value = value.replace("<", "<");
}
if(value.contains(">")){
value = value.replace(">", ">");
}
request.getSession().setAttribute("sqlInjectError", "the request parameter \""+value+"\" contains keyword: \""+word+"\"");
response.sendRedirect(request.getContextPath()+error);
return;
}
}
}
fc.doFilter(req, res);
}
public void init(FilterConfig conf) throws ServletException {
String sql = conf.getInitParameter("invalidsql");
String errorpage = conf.getInitParameter("error");
String de = conf.getInitParameter("debug");
if(errorpage != null){
error = errorpage;
}
if(sql != null){
invalidsql = Arrays.asList(sql.split(" "));
}
if(de != null && Boolean.parseBoolean(de)){
debug = true;
System.out.println("PreventSQLInject Filter staring...");
System.out.println("print filter details");
System.out.println("invalid words as fllows (split with blank):");
for(String s : invalidsql){
System.out.print(s+" ");
}
System.out.println();
System.out.println("error page as fllows");
System.out.println(error);
System.out.println();
}
}
}
2.web.xml中添加如下配置：
