dmp

    /**
     * 校验查询数据入后端时是否存在sql注入问题
     * @param str
     * @return
     */
    public static boolean sqlValidate(String str) {
        if(StringUtils.isBlank(str)){
            return false;
        }
        str = str.toLowerCase();//统一转为小写
//        "(?:')|(?:--)|(/\\*(?:.|[\\n\\r])*?\\*/)|"
//                +
        String badStr = "(\\b(select|select|update|like|delete|insert|truncate|" +
                "dbms|create|into|and|substr|ascii|declare|column|" +
                "exec|count|master|into|drop|exist|group by|table|master|sitename|net user" +
                "|truncate|declare|ascii|order by|execute|'|’|”|<|execute)\\b)";
        String[] badStrs = badStr.split("\\|");
        for (int i = 0; i < badStrs.length; i++) {
            if (str.indexOf(badStrs[i]) >= 0) {
                log.error("非法字符：{}",badStrs[i]);
                return true;
            }
        }
        return false;
    }