Commons-lang Common Tool Class Stringescapeutils

In Apache Commons-lang (more than 2.3), we have provided a handy tool class for escaping, mainly to prevent SQL injection, the function of XSS injection attack. In total, the following methods are available:

1.ESCAPESQL provides SQL transfer capabilities to prevent SQL injection attacks, such as typical universal password attacks ' or 1=1 '

1. StringBuffer sql = new StringBuffer ("Select Key_sn,remark,create_date from Tb_selogon_key where 1=1");
2. if (! Commutil.isempty (KeyWord)) {
3. Sql.append ("and like '%" + stringescapeutils.escapesql (KeyWord) + "% '");
4. }

StringBuffer sql = new StringBuffer ("Select Key_sn,remark,create_date from Tb_selogon_key where 1=1"); Commutil.isempty (KeyWord)) {Sql.append ("and like '%" + stringescapeutils.escapesql (keyWord) + "% '");}

2.escapehtml/unescapehtml Escape/Invert semantic HTML script

1. System.     out.println (stringescapeutils.escapehtml ("<a>dddd</a>"));
2. Output is:&lt;a&gt;dddd&lt;/a&gt;

System.out.println (stringescapeutils.escapehtml ("<a>dddd</a>"));   Output is:&lt;a&gt;dddd&lt;/a&gt;

1. System.     out.println (stringescapeutils.unescapehtml ("&lt;a&gt;dddd&lt;/a&gt;"));
2. Output is:<a>ddd</a>

System.out.println (stringescapeutils.unescapehtml ("&lt;a&gt;dddd&lt;/a&gt;"));   Output is:<a>ddd</a>

3.escapejavascript/unescapejavascript Escape/Invert Semantic JS script

1. System.     out.println (Stringescapeutils.escapejavascript ("<script>alert (' 1111 ') </script>");
2. Output: &lt;script&gt;alert (' 111 ') &lt;/script&gt;

System.out.println (Stringescapeutils.escapejavascript ("<script>alert (' 1111 ') </script>");   Output: &lt;script&gt;alert (' 111 ') &lt;/script&gt;

4.escapejava/unescapejava Converting a string to Unicode encoding

1. System.     out.println (Stringescapeutils.escapejava ("China"));
2. The output is: the string after escaping with the Escapejava method is:/u4e2d/u56fd/u5171/u4ea7/u515a

Commons-lang Common Tool Class Stringescapeutils