防范sql注入式攻击(Java字符串校验，高可用性)

package StrTest;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

public class demo {
	public static void main(String[] args) {
		boolean isf = containsSqlInjection("http://127.0.0.1:8081/login?name=admin &pass=admin' and '1=1");
		System.out.println(isf?"sql注入攻击":"安全字符串");
	}

	/**
	 * 是否含有sql注入，返回true表示含有
	 * 
	 * @param obj
	 * @return
	 */
	public static boolean containsSqlInjection(Object obj) {
		Pattern pattern = Pattern.compile(
				"\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(\\*|;|\\+|'|%)");
		Matcher matcher = pattern.matcher(obj.toString());
		return matcher.find();
	}

}