簡單聊一聊SQL隱碼攻擊及防止SQL隱碼攻擊

package JDBCtest;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
import java.util.Scanner;

/*
 * 使用者登入
 */
public class Demo4 {

    public static void main(String[] args) throws Exception {
        // 1.載入驅動
        Class.forName("com.mysql.jdbc.Driver");
        // 2.建立連線
        String url = "jdbc:mysql:///test";
        String username = "root";
        String password = "1234";
        Connection connection = DriverManager.getConnection(url, username, password);
        // 接收使用者名稱密碼
        Scanner sc = new Scanner(System.in);
        String name = sc.next();
        String pass = sc.next();// 3.sql語句
        String sql = "Select * from user where name='" + name + "' and pass ='" + pass + "'";
        // System.out.println(sql);
        // 4.獲取sql物件statement
        Statement statement = connection.createStatement();
        // 5.執行sql語句
        ResultSet rs = statement.executeQuery(sql);
                // 6.登入
        if (rs.next()) {
            System.out.println("登入成功");
        } else {
            System.out.println("登入失敗");
        }
        // 7.釋放資源
        statement.close();
        connection.close();
    }
}

        String sql = "Select * from user where name='" + name + "' and pass ='" + pass + "'";

public List<Course> orderList(String studentId){
    String sql = "select id,course_id,student_id,status from course where student_id = ?";
    return jdbcTemplate.query(sql,new Object[]{studentId},new BeanPropertyRowMapper(Course.class));
}

@Component
public class SqlInjectionFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req=(HttpServletRequest)servletRequest;
        HttpServletRequest res=(HttpServletRequest)servletResponse;
        //獲得所有請求引數名
        Enumeration params = req.getParameterNames();
        String sql = "";
        while (params.hasMoreElements()) {
            // 得到引數名
            String name = params.nextElement().toString();
            // 得到引數對應值
            String[] value = req.getParameterValues(name);
            for (int i = 0; i < value.length; i++) {
                sql = sql + value[i];
            }
        }
        if (sqlValidate(sql)) {
            throw new IOException("您傳送請求中的引數中含有非法字元");
        } else {
            chain.doFilter(servletRequest,servletResponse);
        }
    }

    /**
     * 關鍵詞校驗
     * @param str
     * @return
     */
    protected static boolean sqlValidate(String str) {
        // 統一轉為小寫
        str = str.toLowerCase();
        // 過濾掉的sql關鍵字，可以手動新增
        String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|*|%|chr|mid|master|truncate|" +
                "char|declare|sitename|net user|xp_cmdshell|;|or|-|+|,|like'|and|exec|execute|insert|create|drop|" +
                "table|from|grant|use|group_concat|column_name|" +
                "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|" +
                "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
        String[] badStrs = badStr.split("\|");
        for (int i = 0; i < badStrs.length; i++) {
            if (str.indexOf(badStrs[i]) >= 0) {
                return true;
            }
        }
        return false;
    }
}