Java Filter防止sql注入攻擊

最後更新：2014-12-18 來源：互聯網

上載者：User

創建阿里雲帳戶，並獲得超過 40 款產品的免費試用版；而企業帳戶則可以享有總值 $1200 的免費試用版。立即註冊！

標籤：des style http ar io color 使用 sp for

原理，過濾所有請求中含有非法的字元，例如：, & < select delete 等關鍵字，駭客可以利用這些字元進行注入攻擊，原理是後台實現使用拼接字串，案例：
某個網站的登入驗證的SQL查詢代碼為

strSQL = "SELECT * FROM users WHERE (name = ‘" + userName + "‘) and (pw = ‘"+ passWord +"‘);"

惡意填入

userName = "‘ OR ‘1‘=‘1";與passWord = "‘ OR ‘1‘=‘1";時，將導致原本的SQL字串被填為

strSQL = "SELECT * FROM users WHERE (name = ‘‘ OR ‘1‘=‘1‘) and (pw = ‘‘ OR ‘1‘=‘1‘);"

也就是實際上啟動並執行SQL命令會變成下面這樣的

strSQL = "SELECT * FROM users;"

因此達到無帳號密碼，亦可登入網站。所以SQL注入攻擊被俗稱為駭客的填空遊戲。

實現三個步驟：

1，編寫filter

2，配置xml

3，配置error.jsp

filter代碼；

package cn.kepu.filter;

import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
import java.util.Map;
import java.util.Set;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
/**
* 防止sql注入，自訂filter www.2cto.com
* cn.kepu.filter.SqlInjectFilter.java
* @author ffr
* created at 2012-7-12
*/
public class SqlInjectFilter implements Filter {

private static List<String> invalidsql = new ArrayList<String>();
private static String error = "/error.jsp";
private static boolean debug = false;

public void destroy() {

}
public void doFilter(ServletRequest req, ServletResponse res,
FilterChain fc) throws IOException, ServletException {
if(debug){
System.out.println("prevent sql inject filter works");
}
HttpServletRequest request = (HttpServletRequest)req;
HttpServletResponse response = (HttpServletResponse)res;
Map<String, String> params = request.getParameterMap();
Set<String> keys = params.keySet();
for(String key : keys){
String value = request.getParameter(key);
if(debug){
System.out.println("process params <key, value>: <"+key+", "+value+">");
}
for(String word : invalidsql){
if(word.equalsIgnoreCase(value) || value.contains(word)){
if(value.contains("<")){
value = value.replace("<", "<");
}
if(value.contains(">")){
value = value.replace(">", ">");
}
request.getSession().setAttribute("sqlInjectError", "the request parameter \""+value+"\" contains keyword: \""+word+"\"");
response.sendRedirect(request.getContextPath()+error);
return;
}
}
}
fc.doFilter(req, res);
}
public void init(FilterConfig conf) throws ServletException {
String sql = conf.getInitParameter("invalidsql");
String errorpage = conf.getInitParameter("error");
String de = conf.getInitParameter("debug");
if(errorpage != null){
error = errorpage;
}
if(sql != null){
invalidsql = Arrays.asList(sql.split(" "));
}
if(de != null && Boolean.parseBoolean(de)){
debug = true;
System.out.println("PreventSQLInject Filter staring...");
System.out.println("print filter details");
System.out.println("invalid words as fllows (split with blank):");
for(String s : invalidsql){
System.out.print(s+" ");
}
System.out.println();
System.out.println("error page as fllows");
System.out.println(error);
System.out.println();
}
}
}
2.web.xml中添加如下配置：

[html]
<filter>
<filter-name>PreventSqlInject</filter-name>
<filter-class>cn.kepu.filter.SqlInjectFilter</filter-class>

<init-param>
<param-name>invalidsql</param-name>
<param-value>select insert delete from update create destory drop alter and or like exec count chr mid master truncate char declare ; - ‘ % < ></param-value>
</init-param>

<init-param>
<param-name>error</param-name>
<param-value>/error.jsp</param-value>
</init-param>

<init-param>
<param-name>debug</param-name>
<param-value>true</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>PreventSqlInject</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

3，在根目錄下添加error.jsp
[plain]
<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%>
<%
String path = request.getContextPath();
%>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<title>防sql注入系統</title>
</head>

<body>
這個是防sql注入系統，自動過濾您的請求，請更換請求字串。
<%=session.getAttribute("sqlInjectError")%>
<p><a href="<%=path%>">點此返回</a></p>
</body>

Java Filter防止sql注入攻擊

本文章原先以中文撰寫並發佈於 aliyun.com，亦設英文版本，僅作資訊用途。本網站不對文章的準確性，完整性或可靠性或其任何翻譯作出任何明示或暗示的陳述或保證。如對該文章有任何疑慮或投訴，請傳送電郵至 info-contact@alibabacloud.com 並提供相關疑慮或投訴的詳細說明。職員會於 5 個工作天內與您聯絡，一經驗證之後，即會刪除該侵權內容。

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

Get Started for Free

Sales Support

1 on 1 presale consultation

Chat Contact Sales
After-Sales Support

24/7 Technical Support 6 Free Tickets per Quarter Faster Response

Open a Ticket
Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.

Learn More