filter过滤非法字符

记录：非法字符过滤 servletFilter,用户session验证servletFilter2010-02-03 11:19servletFilter 是非常强大的。 

能过滤 页面提交过来的所有参数的内容，，例如用户可能会在表单中加入<script><script>这种字符，后果可是恐怖的。 

现在发布一个非法字符转义的filter 

JAVA CODE: 

package com.jcxsw.filter; 

import java.io.IOException; 


import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 


public class IllegalCharacterFilter implements Filter { 

private static final long serialVersionUID = -5916500037685553487L; 


public void destroy() { 
   // TODO Auto-generated method stub 

} 

@SuppressWarnings("unchecked") 
public void doFilter(ServletRequest request, ServletResponse response, 
    FilterChain arg2) throws IOException, ServletException { 
   HttpServletRequest servletrequest = (HttpServletRequest) request; 
   HttpServletResponse servletresponse = (HttpServletResponse) response; 
   String param = ""; 
   String paramValue = ""; 

   servletresponse.setContentType("text/html"); 
   servletresponse.setCharacterEncoding("gbk"); 
   servletrequest.setCharacterEncoding("gbk"); 
   java.util.Enumeration params = request.getParameterNames(); 
   while (params.hasMoreElements()) { 

    param = (String) params.nextElement(); 
    String[] values = servletrequest.getParameterValues(param);//获得每个参数的value 
   
    for (int i = 0; i < values.length; i++) { 

     paramValue = values[i]; 
    
     paramValue = paramValue.replaceAll("<", "&lt"); 
     paramValue = paramValue.replaceAll(">", "&gt"); 

    //这里还可以增加，如领导人 自动转义成****,可以从数据库中读取非法关键字。 
     values[i] = paramValue; 
    
    

    } 

//把转义后的参数重新放回request中 
    request.setAttribute(param, paramValue); 
   } 
   //继续向下 

   arg2.doFilter(request, response); 

} 

public void init(FilterConfig arg0) throws ServletException { 
   // 初始化 

} 

} 

web.xml code 

<!-- 过滤非法字符 --> 
<filter> 
   <filter-name>IllegalCharacterFilter</filter-name> 
   <filter-class> 
    com.jcxsw.filter.IllegalCharacterFilter 
   </filter-class> 
</filter> 
<filter-mapping> 
   <filter-name>IllegalCharacterFilter</filter-name> 
   <url-pattern>/*</url-pattern> <!--这种配置，可能连图片都会被过滤在内，它不支持不等于，与正则，不过可以在初始化中自己定义正则，通过filter来解析，把不符合的pass掉--> 
</filter-mapping> 

再发布一个验证session的filter 

JAVA CODE: 

package com.jcxsw.filter; 

import java.io.IOException; 

import javax.servlet.Filter; 
import javax.servlet.FilterChain; 
import javax.servlet.FilterConfig; 
import javax.servlet.ServletException; 
import javax.servlet.ServletRequest; 
import javax.servlet.ServletResponse; 
import javax.servlet.http.HttpServletRequest; 
import javax.servlet.http.HttpServletResponse; 

import com.jcxsw.member.vo.MemberUser; 

public class MemberAuthorityFilter implements Filter { 

public void destroy() { 
   // TODO Auto-generated method stub 

} 

public void doFilter(ServletRequest request, ServletResponse response, 
    FilterChain chain) throws IOException, ServletException { 
   // TODO Auto-generated method stub 
   HttpServletRequest httpReq = (HttpServletRequest) request; 
   HttpServletResponse httpRes = (HttpServletResponse) response; 
   if (request instanceof HttpServletRequest) { 
    MemberUser memberUser = (MemberUser)httpReq.getSession()   
     .getAttribute("memberUser"); 
   
    if(memberUser == null){ 
     httpRes.sendRedirect(httpReq.getContextPath()+"/member-user/login"); 
     return; 
    } 
   
} 
   chain.doFilter(request, response); 

} 

public void init(FilterConfig filterConfig) throws ServletException { 
   // TODO Auto-generated method stub 

} 

} 
web.xml CODE 

<filter-name>MemberAuthorityFilter</filter-name> 
   <filter-class> 
    com.jcxsw.filter.MemberAuthorityFilter 
   </filter-class> 
</filter> 
<filter-mapping> 
   <filter-name>MemberAuthorityFilter</filter-name> 
   <url-pattern>/my/*</url-pattern><!--验证所有my目录下的--> 
</filter-mapping>