Java source code to prevent SQL injection attacks

Java-string filtering class <br/> package cn.com. hbivt. util; <br/>/** <br/> * <p> title: </P> <br/> * <p> description: </P> <br/> * <p> copyright: Copyright (c) 2005 </P> <br/> * <p> company: </P> <br/> * @ author not attributable <br/> * @ version 1.0 <br/> */<br/> public class stringutils {<br/> // filter the characters submitted through the page form <br/> Private Static string [] [] filterchars = {"<", "<" },{ ">", "> "},{"",""},{"/"","""},{"&", "&" },< br/> {"/", "/" },{ "//", "/" },{ "/N ", "<br> "}}; <br/> // filter the characters processed and submitted through JavaScript scripts <br/> Private Static string [] [] filterscriptchars = {"/N ", "/'+/'/n/'+/'"}, <br/> {"/R ",""},{"//", "/'+/' // '+/'"}, <br/> {"/'", "/'+/' // '/' + /'"}}; </P> <p>/** <br/> * use special characters to connect to a string <br/> * @ Param strings the string array to be connected <br/> *@ param spilit_sign connection character <br/> * @ return connection string <br/> */<br/> Public static string stringconnect (string [] strings, string spilit_sign) {<br/> string STR = ""; <br/> for (INT I = 0; I <strings. length; I ++) {<br/> STR + = strings [I] + spilit_sign; <br/>}< br/> return STR; <br/>}</P> <p>/** <br/> * filter special characters in a string <br/> * @ Param STR string to be filtered <br /> * @ return: The filtered string <br/> */<br/> Public static string stringfilter (string Str) {<br/> string [] str_arr = stringspilit (STR, ""); <br/> for (INT I = 0; I <str_arr.length; I ++) {<br/> for (Int J = 0; j <filterchars. length; j ++) {<br/> If (filterchars [J] [0]. equals (str_arr [I]) <br/> str_arr [I] = filterchars [J] [1]; <br/>}< br/> return (stringconnect (str_arr ,"")). trim (); <br/>}</P> <p>/** <br/> * filter special characters (including carriage return characters (/n) in the script) and linefeed (/R )) <br/> * @ Param STR: string to be filtered <br/> * @ return: filtered string <br/> * 2004-12-21 success <br/> */<br/> Public static string stringfilterscriptchar (string Str) {<br/> string [] str_arr = stringspilit (STR, ""); <br/> for (INT I = 0; I <str_arr.length; I ++) {<br/> for (Int J = 0; j <filterscriptchars. length; j ++) {<br/> If (filterscriptchars [J] [0]. equals (str_arr [I]) <br/> str_arr [I] = filterscriptchars [J] [1]; <br/>}< br/> return (stringconnect (str_arr ,"")). trim (); <br/>}</P> <p>/** <br/> * split the string <br/> * @ Param STR <br/> *@ separator of The param spilit_sign string <br/> * @ return String Array obtained after segmentation <br/> */<br/> Public static string [] stringspilit (string STR, string spilit_sign) {<br/> string [] spilit_string = Str. split (spilit_sign); <br/> If (spilit_string [0]. equals ("") <br/>{< br/> string [] new_string = new string [spilit_string.length-1]; <br/> for (INT I = 1; I <spilit_string.length; I ++) <br/> new_string [I-1] = spilit_string [I]; <br/> return new_string; <br/>}< br/> else <br/> return spilit_string; <br/>}</P> <p>/** <br/> * string Character Set conversion <br/> * @ Param STR string to be converted <br/> * @ return: converted string <br/> */<br/> Public static string stringtranscharset (string Str) {<br/> string new_str = NULL; <br/> try {<br/> new_str = new string (Str. getbytes ("iso-8859-1"), "GBK"); <br/>}< br/> catch (exception e) {<br/> E. printstacktrace (); <br/>}< br/> return new_str; <br/>}</P> <p>/** <br/> * test the string processing class <br/> * @ Param ARGs console input parameters <br/> * /<br/> Public static void main (string [] ARGs) {</P> <p> // test string filtering <br/> string t_str1 = "<p> stringdispose string processing/n/R/'/" </p>"; <br/> system. out. println ("before filtering:" + t_str1); <br/> system. out. println ("filtered:" + stringutils. stringfilter (t_str1); <br/> // test the merged string <br/> string [] t_str_arr1 = {"pg_1", "pg_2", "pg_3 "}; <br/> string t_str2 = stringutils. stringconnect (t_str_arr1, ","); <br/> system. out. println (t_str2); <br/> // test the split string <br/> string [] t_str_arr2 = stringutils. stringspilit (t_str2, ","); <br/> for (INT I = 0; I <t_str_arr2.length; I ++) {<br/> system. out. println (t_str_arr2 [I]); <br/>}</P> <p>