防止sql注入

其实就是将一些数据库的关键词在用户输入的后通过参数传入后台后，检验用户传入的参数是够包含该数据库的关键词，来过滤掉。可能这样写有一些漏洞，希望大神们前来纠正错误。下面代码贴上。

 

public class SQLInjectionFilter implements Filter{
    public void destroy() {
        // TODO Auto-generated method stub
    }

    public void init(FilterConfig arg0) throws ServletException {
        // TODO Auto-generated method stub
    }

    public void doFilter(ServletRequest request, ServletResponse response,
            FilterChain chain) throws IOException, ServletException {
        HttpServletRequest req=(HttpServletRequest) request;
        HttpServletResponse res=(HttpServletResponse) response;
            //获得所有请求参数名
            Enumeration params = req.getParameterNames();
            String sql = "";
            //获得请求的URL
            while (params.hasMoreElements()) {
                //得到参数名
                String name = params.nextElement().toString();
                //得到参数对应值
                String[] value = req.getParameterValues(name);
                if(value!=null&&!value[0].equals("-1")){
                    for (int i = 0; i < value.length; i++) {
                        sql = sql + value[i];
                    }
                }
            }
            
            //检验输出的参数是否包含关键词
            if (sqlValidate(sql)) {
                PrintWriter out = res.getWriter();
                out.print("<script>alert('您发送的请求参数中含有非法字符')</script>");
                out.close();
            }else{
                 chain.doFilter(request,response);
            }
    }

    //归总的sql关键词
    protected static boolean sqlValidate(String str) {
        str = str.toLowerCase();//统一转为小写
        String badStr = "'|and|exec|waitfot|delay|sysusers|html|function|group by|database|user|system_user|session_user|substring|" +
                "sysobjects|chongqing|script|ajax|execute|insert|select|delete|update|count|drop|*|%|chr|mid|master|truncate|" +
                "char|declare|sitename|net user|xp_cmdshell|like'|create|table|from|grant|use|group_concat|column_name|" +
                "information_schema.columns|table_schema|union|where|order|by|--|+|like|#";//过滤掉的sql关键字，可以手动添加
        String[] badStrs = badStr.split("\\|");
        for (int i = 0; i < badStrs.length; i++) {
            //循环检测，判断在请求参数当中是否包含SQL关键字
            if (str.indexOf(badStrs[i]) >= 0) {
                return true;
            }
        }
        return false;
    }