java filter 防止sql注入攻击
来源:互联网 发布:希拉克略知乎 编辑:程序博客网 时间:2024/06/05 04:49
原理,过滤所有请求中含有非法的字符,例如:, & < select delete 等关键字,黑客可以利用这些字符进行注入攻击,原理是后台实现使用拼接字符串,案例:
某个网站的登入验证的SQL查询代码为
strSQL = "SELECT * FROM users WHERE (name = '" + userName + "') and (pw = '"+ passWord +"');"
恶意填入
userName = "' OR '1'='1";与passWord = "' OR '1'='1";时,将导致原本的SQL字符串被填为
strSQL = "SELECT * FROM users WHERE (name = '' OR '1'='1') and (pw = '' OR '1'='1');"
也就是实际上运行的SQL命令会变成下面这样的
strSQL = "SELECT * FROM users;"
因此达到无帐号密码,亦可登入网站。所以SQL注入攻击被俗称为黑客的填空游戏。
实现三个步骤:
1,编写filter
2,配置xml
3,配置error.jsp
filter代码;
package cn.kepu.filter;import java.io.IOException;import java.util.ArrayList;import java.util.Arrays;import java.util.List;import java.util.Map;import java.util.Set;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;/** * 防止sql注入,自定义filter * cn.kepu.filter.SqlInjectFilter.java * @author ffr * created at 2012-7-12 */public class SqlInjectFilter implements Filter {private static List<String> invalidsql = new ArrayList<String>();private static String error = "/error.jsp";private static boolean debug = false;public void destroy() {}public void doFilter(ServletRequest req, ServletResponse res,FilterChain fc) throws IOException, ServletException {if(debug){System.out.println("prevent sql inject filter works");}HttpServletRequest request = (HttpServletRequest)req;HttpServletResponse response = (HttpServletResponse)res;Map<String, String> params = request.getParameterMap();Set<String> keys = params.keySet();for(String key : keys){String value = request.getParameter(key);if(debug){System.out.println("process params <key, value>: <"+key+", "+value+">");}for(String word : invalidsql){if(word.equalsIgnoreCase(value) || value.contains(word)){if(value.contains("<")){value = value.replace("<", "<");}if(value.contains(">")){value = value.replace(">", ">");}request.getSession().setAttribute("sqlInjectError", "the request parameter \""+value+"\" contains keyword: \""+word+"\"");response.sendRedirect(request.getContextPath()+error);return;}}}fc.doFilter(req, res);}public void init(FilterConfig conf) throws ServletException {String sql = conf.getInitParameter("invalidsql");String errorpage = conf.getInitParameter("error");String de = conf.getInitParameter("debug");if(errorpage != null){error = errorpage;}if(sql != null){invalidsql = Arrays.asList(sql.split(" "));}if(de != null && Boolean.parseBoolean(de)){debug = true;System.out.println("PreventSQLInject Filter staring...");System.out.println("print filter details");System.out.println("invalid words as fllows (split with blank):");for(String s : invalidsql){System.out.print(s+" ");}System.out.println();System.out.println("error page as fllows");System.out.println(error);System.out.println();}}}
2.web.xml中添加如下配置:
<filter> <filter-name>PreventSqlInject</filter-name> <filter-class>cn.kepu.filter.SqlInjectFilter</filter-class> <!-- filter word, split with blank --> <init-param> <param-name>invalidsql</param-name> <param-value>select insert delete from update create destory drop alter and or like exec count chr mid master truncate char declare ; - ' % < ></param-value> </init-param> <!-- error page --> <init-param> <param-name>error</param-name> <param-value>/error.jsp</param-value> </init-param> <!-- debug --> <init-param><param-name>debug</param-name><param-value>true</param-value></init-param> </filter> <filter-mapping> <filter-name>PreventSqlInject</filter-name> <url-pattern>/*</url-pattern> </filter-mapping>
3,在根目录下添加error.jsp
<%@ page language="java" import="java.util.*" pageEncoding="utf-8"%><%String path = request.getContextPath();%><!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html> <head> <title>防sql注入系统</title> </head> <body>这个是防sql注入系统,自动过滤您的请求,请更换请求字符串。<%=session.getAttribute("sqlInjectError")%><p><a href="<%=path%>">点此返回</a></p> </body></html>
大功告成
源代码可以到此直接下载:源代码demo
- java filter 防止sql注入攻击
- java filter防止sql注入攻击
- 防止SQL注入和XSS攻击Filter
- 防止SQL注入和XSS攻击Filter
- 防止SQL注入和XSS攻击Filter
- 防止SQL注入和XSS攻击Filter
- 防止SQL注入和XSS攻击Filter
- Filter:防止SQL注入和XSS攻击Filter
- 实用:防止SQL、XSS等注入攻击的Filter
- 实用:防止SQL、XSS等注入攻击的Filter
- SQL注入防止攻击
- 防止sql注入攻击
- 防止SQL注入攻击
- 防止SQL注入攻击
- 防止SQL注入攻击
- 防止sql注入攻击
- 防止SQL注入攻击
- 防止SQL注入攻击
- JBOSS5跑不同尚学堂EJB里面的JMS的案例解决
- IM-A820L用CWM时开启自动更新造成Recovery循环的原因(其他泛泰机型可参考)
- Linux yum 命令介绍
- Mysql服务器调优
- linux select 解释
- java filter 防止sql注入攻击
- Learn Python The Hard Way学习(50) - 你的第一个网站
- Linux 抓取网页方式(curl+wget)
- HDU OJ 1506 Largest Rectangle in a Histogram 和 NYOJ 258 最大长方形(二) 【单调队列】
- 数据库设计指南【转后整理】
- Nginx限制目录访问
- Linux 自动删除N天前的文件
- 存储过程
- 数据库建模工具一缆