blocks|key|1179711|text|防止SQL注入的唯一方法是使用参数化SQL。根本不可能构建一个比那些以攻击SQL为生的人更聪明的过滤器。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1179712|所以对所有input、updates和where子句都使用参数。动态SQL只是为黑客打开的一扇门，它包括存储过程中的动态SQL。参数化，参数化，参数化。|1179713|entityMap^0|0|0^^$0|@$1|2|3|4|5|6|7|F|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|G|8|@]|9|@]|A|$]]|$1|D|3|-4|5|6|7|H|8|@]|9|@]|A|$]]]|E|$]]

The only way to prevent SQL injection is with parameterized SQL. It simply isn't possible to build a filter that's smarter than the people who hack SQL for a living.

So use parameters for all input, updates, and where clauses. Dynamic SQL is simply an open door for hackers, and that includes dynamic SQL in stored procedures. Parameterize, parameterize, parameterize.

blocks|key|1395287|text|使用正则表达式删除可能导致SQL注入的文本听起来像是通过Statement而不是PreparedStatement将SQL语句发送到数据库。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1395288|首先防止SQL注入的最简单方法之一是使用PreparedStatement，它接受使用占位符替换成SQL语句的数据，它不依赖于字符串连接来创建要发送到数据库的SQL语句。|1395289|要了解更多信息，可以从The+Java+Tutorials的Using+Prepared+Statements开始。|1395290|entityMap|0|LINK|mutability|MUTABLE|url|http://java.sun.com/javase/6/docs/api/java/sql/Statement.html|1|http://java.sun.com/javase/6/docs/api/java/sql/PreparedStatement.html|2|http://java.sun.com/docs/books/tutorial/index.html|3|http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html^0|S|9|14|H|S|9|0|14|H|1|0|K|H|0|B|I|2|U|P|3|0^^$0|@$1|2|3|4|5|6|7|X|8|@$9|Y|A|Z|B|C]|$9|10|A|11|B|C]]|D|@$9|12|A|13|1|14]|$9|15|A|16|1|17]]|E|$]]|$1|F|3|G|5|6|7|18|8|@$9|19|A|1A|B|C]]|D|@]|E|$]]|$1|H|3|I|5|6|7|1B|8|@]|D|@$9|1C|A|1D|1|1E]|$9|1F|A|1G|1|1H]]|E|$]]|$1|J|3|-4|5|6|7|1I|8|@]|D|@]|E|$]]]|K|$L|$5|M|N|O|E|$P|Q]]|R|$5|M|N|O|E|$P|S]]|T|$5|M|N|O|E|$P|U]]|V|$5|M|N|O|E|$P|W]]]]

Using a regular expression to remove text which could cause a SQL injection sounds like the SQL statement is being sent to the database via a <a href="http://java.sun.com/javase/6/docs/api/java/sql/Statement.html" rel="noreferrer"><code>Statement</code></a> rather than a <a href="http://java.sun.com/javase/6/docs/api/java/sql/PreparedStatement.html" rel="noreferrer"><code>PreparedStatement</code></a>.

One of the easiest ways to prevent an SQL injection in the first place is to use a <code>PreparedStatement</code>, which accepts data to substitute into a SQL statement using placeholders, which does not rely on string concatenations to create an SQL statement to send to the database.

For more information, <a href="http://java.sun.com/docs/books/tutorial/jdbc/basics/prepared.html" rel="noreferrer">Using Prepared Statements</a> from <a href="http://java.sun.com/docs/books/tutorial/index.html" rel="noreferrer">The Java Tutorials</a> would be a good place to start.

blocks|key|1179850|text|PreparedStatements是最好的选择，因为它们使得SQL注入变得不可能。下面是一个将用户的输入作为参数的简单示例：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1179851|public+insertUser(String+name,+String+email)+{
+++Connection+conn+=+null;
+++PreparedStatement+stmt+=+null;
+++try+{
++++++conn+=+setupTheDatabaseConnectionSomehow();
++++++stmt+=+conn.prepareStatement("INSERT+INTO+person+(name,+email)+values+(?,+?)");
++++++stmt.setString(1,+name);
++++++stmt.setString(2,+email);
++++++stmt.executeUpdate();
+++}
+++finally+{
++++++try+{
+++++++++if+(stmt+!=+null)+{+stmt.close();+}
++++++}
++++++catch+(Exception+e)+{
+++++++++//+log+this+error
++++++}
++++++try+{
+++++++++if+(conn+!=+null)+{+conn.close();+}
++++++}
++++++catch+(Exception+e)+{
+++++++++//+log+this+error
++++++}
+++}
}|code-block|syntax|javascript|1179852|无论名称和电子邮件中是什么字符，这些字符都将直接放入数据库中。它们不会以任何方式影响INSERT语句。|1179853|不同的数据类型有不同的set方法--您使用哪种方法取决于您的数据库字段是什么。例如，如果数据库中有一个整型列，则应使用setInt方法。The+PreparedStatement+documentation列出了可用于设置和获取数据的所有不同方法。|offset|length|style|CODE|1179854|entityMap|0|LINK|mutability|MUTABLE|url|http://java.sun.com/javase/6/docs/api/java/sql/PreparedStatement.html^0|0|0|0|1N|6|1W|Z|0|0^^$0|@$1|2|3|4|5|6|7|W|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|X|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|Y|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|Z|8|@$K|10|L|11|M|N]]|9|@$K|12|L|13|1|14]]|A|$]]|$1|O|3|-4|5|6|7|15|8|@]|9|@]|A|$]]]|P|$Q|$5|R|S|T|A|$U|V]]]]

PreparedStatements are the way to go, because they make SQL injection impossible. Here's a simple example taking the user's input as the parameters:

<pre><code>public insertUser(String name, String email) {
 Connection conn = null;
 PreparedStatement stmt = null;
 try {
 conn = setupTheDatabaseConnectionSomehow();
 stmt = conn.prepareStatement("INSERT INTO person (name, email) values (?, ?)");
 stmt.setString(1, name);
 stmt.setString(2, email);
 stmt.executeUpdate();
 }
 finally {
 try {
 if (stmt != null) { stmt.close(); }
 }
 catch (Exception e) {
 // log this error
 }
 try {
 if (conn != null) { conn.close(); }
 }
 catch (Exception e) {
 // log this error
 }
 }
}
</code></pre>

No matter what characters are in name and email, those characters will be placed directly in the database. They won't affect the INSERT statement in any way.

There are different set methods for different data types -- which one you use depends on what your database fields are. For example, if you have an INTEGER column in the database, you should use a <code>setInt</code> method. <a href="http://java.sun.com/javase/6/docs/api/java/sql/PreparedStatement.html" rel="noreferrer">The PreparedStatement documentation</a> lists all the different methods available for setting and getting data.

blocks|key|1179931|text|如果您正在处理遗留系统，或者您有太多地方需要在太短的时间内切换到PreparedStatement，也就是说，如果使用其他答案建议的最佳实践存在障碍，您可以尝试AntiSQLFilter。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1179932|entityMap|0|LINK|mutability|MUTABLE|url|http://sourceforge.net/projects/antisqlfilter/^0|W|H|28|D|0|0^^$0|@$1|2|3|4|5|6|7|N|8|@$9|O|A|P|B|C]]|D|@$9|Q|A|R|1|S]]|E|$]]|$1|F|3|-4|5|6|7|T|8|@]|D|@]|E|$]]]|G|$H|$5|I|J|K|E|$L|M]]]]

In case you are dealing with a legacy system, or you have too many places to switch to <code>PreparedStatement</code>s in too little time - i.e. if there is an obstacle to using the best practice suggested by other answers, you can try <a href="http://sourceforge.net/projects/antisqlfilter/" rel="noreferrer">AntiSQLFilter</a>

blocks|key|1395479|text|(这是对OP在原始问题下的评论的回答；我完全同意PreparedStatement是这项工作的工具，而不是正则表达式。)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1395480|当您说\n时，您指的是\%2Bn序列还是实际的换行符？如果是\%2Bn，任务非常简单：|offset|length|style|CODE|1395481|s+=+s.replaceAll("['\"\\\\]",+"\\\\$0");|code-block|syntax|javascript|1395482|要匹配输入中的一个反斜杠，可以在regex字符串中放入四个反斜杠。要在输出中放入一个反斜杠，可以在替换字符串中放入四个反斜杠。这里假设您正在以Java字符串文字的形式创建正则表达式和替换。如果您以其他方式创建它们(例如，通过从文件中读取它们)，则不必进行所有的双重转义。|1395483|如果您在输入中有一个换行符，并且您想用转义序列替换它，您可以使用以下命令对输入进行第二次传递：|1395484|s+=+s.replaceAll("\n",+"\\\\n");|1395485|或者你可能想要两个反斜杠(我不太清楚)：|1395486|s+=+s.replaceAll("\n",+"\\\\\\\\n");|1395487|entityMap^0|0|3|2|B|1|D|1|S|1|U|1|0|0|0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|Y|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|Z|8|@$D|10|E|11|F|G]|$D|12|E|13|F|G]|$D|14|E|15|F|G]|$D|16|E|17|F|G]|$D|18|E|19|F|G]]|9|@]|A|$]]|$1|H|3|I|5|J|7|1A|8|@]|9|@]|A|$K|L]]|$1|M|3|N|5|6|7|1B|8|@]|9|@]|A|$]]|$1|O|3|P|5|6|7|1C|8|@]|9|@]|A|$]]|$1|Q|3|R|5|J|7|1D|8|@]|9|@]|A|$K|L]]|$1|S|3|T|5|6|7|1E|8|@]|9|@]|A|$]]|$1|U|3|V|5|J|7|1F|8|@]|9|@]|A|$K|L]]|$1|W|3|-4|5|6|7|1G|8|@]|9|@]|A|$]]]|X|$]]

(This is in answer to the OP's comment under the original question; I agree completely that PreparedStatement is the tool for this job, not regexes.)

When you say <code>\n</code>, do you mean the sequence <code>\</code>+<code>n</code> or an actual linefeed character? If it's <code>\</code>+<code>n</code>, the task is pretty straightforward:

<pre><code>s = s.replaceAll("['\"\\\\]", "\\\\$0");
</code></pre>

To match one backslash in the input, you put four of them in the regex string. To put one backslash in the output, you put four of them in the replacement string. This is assuming you're creating the regexes and replacements in the form of Java String literals. If you create them any other way (e.g., by reading them from a file), you don't have to do all that double-escaping.

If you have a linefeed character in the input and you want to replace it with an escape sequence, you can make a second pass over the input with this:

<pre><code>s = s.replaceAll("\n", "\\\\n");
</code></pre>

Or maybe you want two backslashes (I'm not too clear on that):

<pre><code>s = s.replaceAll("\n", "\\\\\\\\n");
</code></pre>

blocks|key|1395529|text|PreparedStatements在大多数情况下是可行的，但不是所有情况下都是这样。有时，您会发现自己处于这样一种情况:必须构建查询或查询的一部分，并将其存储为字符串以供以后使用。有关不同编程语言的更多详细信息和API，请查看OWASP+Site上的SQL+Injection+Prevention+Cheat+Sheet。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1395530|entityMap|0|LINK|mutability|MUTABLE|url|http://www.owasp.org/|1|http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet^0|36|A|0|3I|10|1|0^^$0|@$1|2|3|4|5|6|7|N|8|@]|9|@$A|O|B|P|1|Q]|$A|R|B|S|1|T]]|C|$]]|$1|D|3|-4|5|6|7|U|8|@]|9|@]|C|$]]]|E|$F|$5|G|H|I|C|$J|K]]|L|$5|G|H|I|C|$J|M]]]]

PreparedStatements are the way to go in most, but not all cases. Sometimes you will find yourself in a situation where a query, or a part of it, has to be built and stored as a string for later use. Check out the <a href="http://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet" rel="noreferrer">SQL Injection Prevention Cheat Sheet</a> on the <a href="http://www.owasp.org/" rel="noreferrer">OWASP Site</a> for more details and APIs in different programming languages.

blocks|key|1395592|text|您需要以下代码。乍一看，这可能看起来像我编写的任何旧代码。但是，我所做的是查看http://grepcode.com/file/repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.31/com/mysql/jdbc/PreparedStatement.java的源代码。然后，我仔细查看了setString(int+parameterIndex，String+x)的代码，以找到它转义的字符，并将其定制为我自己的类，以便它可以用于您需要的目的。毕竟，如果这是Oracle转义的字符列表，那么知道这一点在安全性方面是非常令人欣慰的。也许Oracle需要在下一个主要Java版本中添加类似于此的方法。|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1395593|public+class+SQLInjectionEscaper+{

++++public+static+String+escapeString(String+x,+boolean+escapeDoubleQuotes)+{
++++++++StringBuilder+sBuilder+=+new+StringBuilder(x.length()+*+11/10);

++++++++int+stringLength+=+x.length();

++++++++for+(int+i+=+0;+i+<+stringLength;+%2B%2Bi)+{
++++++++++++char+c+=+x.charAt(i);

++++++++++++switch+(c)+{
++++++++++++case+0:+/*+Must+be+escaped+for+'mysql'+*/
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('0');

++++++++++++++++break;

++++++++++++case+'\n':+/*+Must+be+escaped+for+logs+*/
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('n');

++++++++++++++++break;

++++++++++++case+'\r':
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('r');

++++++++++++++++break;

++++++++++++case+'\\':
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('\\');

++++++++++++++++break;

++++++++++++case+'\'':
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('\'');

++++++++++++++++break;

++++++++++++case+'"':+/*+Better+safe+than+sorry+*/
++++++++++++++++if+(escapeDoubleQuotes)+{
++++++++++++++++++++sBuilder.append('\\');
++++++++++++++++}

++++++++++++++++sBuilder.append('"');

++++++++++++++++break;

++++++++++++case+'\032':+/*+This+gives+problems+on+Win32+*/
++++++++++++++++sBuilder.append('\\');
++++++++++++++++sBuilder.append('Z');

++++++++++++++++break;

++++++++++++case+'\u00a5':
++++++++++++case+'\u20a9':
++++++++++++++++//+escape+characters+interpreted+as+backslash+by+mysql
++++++++++++++++//+fall+through

++++++++++++default:
++++++++++++++++sBuilder.append(c);
++++++++++++}
++++++++}

++++++++return+sBuilder.toString();
++++}
}|code-block|syntax|javascript|1395594|entityMap|0|LINK|mutability|MUTABLE|url|http://grepcode.com/file/repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.31/com/mysql/jdbc/PreparedStatement.java^0|13|3B|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

You need the following code below. At a glance, this may look like any old code that I made up. However, what I did was look at the source code for <a href="http://grepcode.com/file/repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.31/com/mysql/jdbc/PreparedStatement.java" rel="noreferrer">http://grepcode.com/file/repo1.maven.org/maven2/mysql/mysql-connector-java/5.1.31/com/mysql/jdbc/PreparedStatement.java</a>. Then after that, I carefully looked through the code of setString(int parameterIndex, String x) to find the characters which it escapes and customised this to my own class so that it can be used for the purposes that you need. After all, if this is the list of characters that Oracle escapes, then knowing this is really comforting security-wise. Maybe Oracle need a nudge to add a method similar to this one for the next major Java release.

<pre><code>public class SQLInjectionEscaper {

 public static String escapeString(String x, boolean escapeDoubleQuotes) {
 StringBuilder sBuilder = new StringBuilder(x.length() * 11/10);

 int stringLength = x.length();

 for (int i = 0; i &lt; stringLength; ++i) {
 char c = x.charAt(i);

 switch (c) {
 case 0: /* Must be escaped for 'mysql' */
 sBuilder.append('\\');
 sBuilder.append('0');

 break;

 case '\n': /* Must be escaped for logs */
 sBuilder.append('\\');
 sBuilder.append('n');

 break;

 case '\r':
 sBuilder.append('\\');
 sBuilder.append('r');

 break;

 case '\\':
 sBuilder.append('\\');
 sBuilder.append('\\');

 break;

 case '\'':
 sBuilder.append('\\');
 sBuilder.append('\'');

 break;

 case '"': /* Better safe than sorry */
 if (escapeDoubleQuotes) {
 sBuilder.append('\\');
 }

 sBuilder.append('"');

 break;

 case '\032': /* This gives problems on Win32 */
 sBuilder.append('\\');
 sBuilder.append('Z');

 break;

 case '\u00a5':
 case '\u20a9':
 // escape characters interpreted as backslash by mysql
 // fall through

 default:
 sBuilder.append(c);
 }
 }

 return sBuilder.toString();
 }
}
</code></pre>

blocks|key|1395618|text|准备好的语句是最好的解决方案，但如果确实需要手动完成，也可以使用Apache+Commons-Lang库中的StringEscapeUtils类。它有一个escapeSql(String)方法，您可以使用它：|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1395619|import+org.apache.commons.lang.StringEscapeUtils;+…+String+escapedSQL+=+StringEscapeUtils.escapeSql(unescapedSQL);|1395620|entityMap|0|LINK|mutability|MUTABLE|url|https://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringEscapeUtils.html|1|https://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringEscapeUtils.html#escapeSql(java.lang.String)^0|1I|H|25|H|1I|H|0|25|H|1|0|0|36|0^^$0|@$1|2|3|4|5|6|7|R|8|@$9|S|A|T|B|C]|$9|U|A|V|B|C]]|D|@$9|W|A|X|1|Y]|$9|Z|A|10|1|11]]|E|$]]|$1|F|3|G|5|6|7|12|8|@$9|13|A|14|B|C]]|D|@]|E|$]]|$1|H|3|-4|5|6|7|15|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]|P|$5|K|L|M|E|$N|Q]]]]

Prepared Statements are the best solution, but if you really need to do it manually you could also use the <a href="https://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringEscapeUtils.html" rel="noreferrer"><code>StringEscapeUtils</code></a> class from the Apache Commons-Lang library. It has an <a href="https://commons.apache.org/proper/commons-lang/javadocs/api-2.6/org/apache/commons/lang/StringEscapeUtils.html#escapeSql(java.lang.String)" rel="noreferrer"><code>escapeSql(String)</code></a> method, which you can use:

<code>import org.apache.commons.lang.StringEscapeUtils;
…
String escapedSQL = StringEscapeUtils.escapeSql(unescapedSQL);
</code>

blocks|key|1395625|text|来自：Source|type|unstyled|depth|inlineStyleRanges|entityRanges|offset|length|data|1395626|public+String+MysqlRealScapeString(String+str){
++String+data+=+null;
++if+(str+!=+null+&&+str.length()+>+0)+{
++++str+=+str.replace("\\",+"\\\\");
++++str+=+str.replace("'",+"\\'");
++++str+=+str.replace("\0",+"\\0");
++++str+=+str.replace("\n",+"\\n");
++++str+=+str.replace("\r",+"\\r");
++++str+=+str.replace("\"",+"\\\"");
++++str+=+str.replace("\\x1a",+"\\Z");
++++data+=+str;
++}
++return+data;
}|code-block|syntax|javascript|1395627|entityMap|0|LINK|mutability|MUTABLE|url|http://mashfiqur.blogspot.com/2013/06/mysql-real-escape-string-in-java.html^0|3|6|0|0|0^^$0|@$1|2|3|4|5|6|7|Q|8|@]|9|@$A|R|B|S|1|T]]|C|$]]|$1|D|3|E|5|F|7|U|8|@]|9|@]|C|$G|H]]|$1|I|3|-4|5|6|7|V|8|@]|9|@]|C|$]]]|J|$K|$5|L|M|N|C|$O|P]]]]

From:<a href="http://mashfiqur.blogspot.com/2013/06/mysql-real-escape-string-in-java.html" rel="nofollow noreferrer">Source</a>
<pre><code>public String MysqlRealScapeString(String str){
 String data = null;
 if (str != null &amp;&amp; str.length() &gt; 0) {
 str = str.replace(&quot;\\&quot;, &quot;\\\\&quot;);
 str = str.replace(&quot;'&quot;, &quot;\\'&quot;);
 str = str.replace(&quot;\0&quot;, &quot;\\0&quot;);
 str = str.replace(&quot;\n&quot;, &quot;\\n&quot;);
 str = str.replace(&quot;\r&quot;, &quot;\\r&quot;);
 str = str.replace(&quot;\&quot;&quot;, &quot;\\\&quot;&quot;);
 str = str.replace(&quot;\\x1a&quot;, &quot;\\Z&quot;);
 data = str;
 }
 return data;
}
</code></pre>

blocks|key|1395686|text|如果你正在使用PL/SQL，你也可以使用DBMS_ASSERT，它可以净化你的输入，这样你就可以不用担心SQL注入了。|type|unstyled|depth|inlineStyleRanges|offset|length|style|CODE|entityRanges|data|1395687|例如，请参阅此答案：https://stackoverflow.com/a/21406499/1726419|1395688|entityMap|0|LINK|mutability|MUTABLE|url|https://stackoverflow.com/a/21406499/1726419^0|K|B|0|A|18|0|0^^$0|@$1|2|3|4|5|6|7|P|8|@$9|Q|A|R|B|C]]|D|@]|E|$]]|$1|F|3|G|5|6|7|S|8|@]|D|@$9|T|A|U|1|V]]|E|$]]|$1|H|3|-4|5|6|7|W|8|@]|D|@]|E|$]]]|I|$J|$5|K|L|M|E|$N|O]]]]

If you are using PL/SQL you can also use <code>DBMS_ASSERT</code>
it can sanitize your input so you can use it without worrying about SQL injections.

see this answer for instance:
<a href="https://stackoverflow.com/a/21406499/1726419">https://stackoverflow.com/a/21406499/1726419</a>

blocks|key|1395724|text|首先，提出一个问题--用户输入字段中需要双引号、单引号还是反斜杠？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1395725|反斜杠-不。双引号和单引号在英语中很少使用，而且在英国和美国的用法也不同。|1395726|我说移除或替换它们，你就会变得简单。|1395727|private+String+scrub(
++++String+parameter,
++++int++++length
++++)
{
++++String+parm+=+null;

++++if+(+parameter+!=+null+&&+parameter.length()+>+0+&&+parameter.length()+<+length+)
++++{
++++++++parm+=+parameter
++++++++++++.replace(+"\\",+"+"+)
++++++++++++.replace(+"\"",+"+"+)
++++++++++++.replace(+"\'",+"+"+)
++++++++++++.replace(+"\t",+"+"+)
++++++++++++.replace(+"\r",+"+"+)
++++++++++++.replace(+"\n",+"+"+)
++++++++++++.trim();
++++}

++++return+parm;
}|code-block|syntax|javascript|1395728|entityMap^0|0|0|0|0^^$0|@$1|2|3|4|5|6|7|M|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|N|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|O|8|@]|9|@]|A|$]]|$1|F|3|G|5|H|7|P|8|@]|9|@]|A|$I|J]]|$1|K|3|-4|5|6|7|Q|8|@]|9|@]|A|$]]]|L|$]]

First, ask the question - are double or single quotes, or backslashes needed in user entry fields?
Backslashes - no. Double and single quotes are rarely used in English and they are used differently in Britain than the U.S.
I say remove or replace them and you simplify.
<pre><code>private String scrub(
 String parameter,
 int length
 )
{
 String parm = null;

 if ( parameter != null &amp;&amp; parameter.length() &gt; 0 &amp;&amp; parameter.length() &lt; length )
 {
 parm = parameter
 .replace( &quot;\\&quot;, &quot; &quot; )
 .replace( &quot;\&quot;&quot;, &quot; &quot; )
 .replace( &quot;\'&quot;, &quot; &quot; )
 .replace( &quot;\t&quot;, &quot; &quot; )
 .replace( &quot;\r&quot;, &quot; &quot; )
 .replace( &quot;\n&quot;, &quot; &quot; )
 .trim();
 }

 return parm;
}
</code></pre>

I'm trying to put some anti sql injection in place in java and am finding it very difficult to work with the the "replaceAll" string function. Ultimately I need a function that will convert any existing <code>\</code> to <code>\\</code>, any <code>"</code> to <code>\"</code>, any <code>'</code> to <code>\'</code>, and any <code>\n</code> to <code>\\n</code> so that when the string is evaluated by MySQL SQL injections will be blocked. 

I've jacked up some code I was working with and all the <code>\\\\\\\\\\\</code> in the function are making my eyes go nuts. If anyone happens to have an example of this I would greatly appreciate it.

Java - escape string to prevent SQL injection

我正在尝试在java中加入一些反sql注入，但我发现使用"replaceAll“字符串函数非常困难。最终，我需要一个函数，它可以将任何现有的\转换为\\，将任何"转换为\"，将任何'转换为\'，以及将任何\n转换为\\n，这样当字符串由SQL求值时，MySQL注入将被阻塞。我用千克顶起了一些我正在处理的代码，函数中的所...

问用于防止SQL注入的Java转义字符串
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问用于防止SQL注入的Java转义字符串EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问用于防止SQL注入的Java转义字符串
EN