filter过滤非法字符

我想过滤掉非法字符，sql字符和html,css,javascript等，不知道怎么做。

这只是提供一个样本让你参观下，

可以以参数的方式来配置正则表达式，以过滤字符，当然这部分要自己去实现

<!-- 过滤器 -->
<filter>
    <filter-name>encodingFilter</filter-name>
    <filter-class>com.zte.ssb.filter.EncodingFilter</filter-class>
    <init-param>
        <param-name>filtCharReg</param-name>
        <param-value>这里就配置正则表达式</param-value>
    </init-param>

</filter>

当然你还要在init方法里读取这个配置来解析

用StringEscapeUtils这个类试试，google一下，看是不是你想要的

记录：非法字符过滤 servletFilter,用户session验证servletFilter2010-02-03 11:19servletFilter 是非常强大的。

能过滤页面提交过来的所有参数的内容，，例如用户可能会在表单中加入<script>这种字符，后果可是恐怖的。 现在发布一个非法字符转义的filter JAVA CODE: package com.jcxsw.filter; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; public class IllegalCharacterFilter implements Filter { private static final long serialVersionUID = -5916500037685553487L; public void destroy() { // TODO Auto-generated method stub } @SuppressWarnings("unchecked") public void doFilter(ServletRequest request, ServletResponse response, FilterChain arg2) throws IOException, ServletException { HttpServletRequest servletrequest = (HttpServletRequest) request; HttpServletResponse servletresponse = (HttpServletResponse) response; String param = ""; String paramValue = ""; servletresponse.setContentType("text/html"); servletresponse.setCharacterEncoding("gbk"); servletrequest.setCharacterEncoding("gbk"); java.util.Enumeration params = request.getParameterNames(); while (params.hasMoreElements()) { <pre><code>param = (String) params.nextElement(); String[] values = servletrequest.getParameterValues(param);//获得每个参数的value for (int i = 0; i < values.length; i++) { paramValue = values[i]; paramValue = paramValue.replaceAll("<", "&lt"); paramValue = paramValue.replaceAll(">", "&gt"); //这里还可以增加，如领导人自动转义成****,可以从数据库中读取非法关键字。 values[i] = paramValue; } </code></pre> //把转义后的参数重新放回request中 request.setAttribute(param, paramValue); } //继续向下 arg2.doFilter(request, response); } public void init(FilterConfig arg0) throws ServletException { // 初始化 } } web.xml code  <filter> <filter-name>IllegalCharacterFilter</filter-name> <filter-class> com.jcxsw.filter.IllegalCharacterFilter </filter-class> </filter> <filter-mapping> <filter-name>IllegalCharacterFilter</filter-name> <url-pattern>/*</url-pattern>  </filter-mapping> 再发布一个验证session的filter JAVA CODE: package com.jcxsw.filter; import java.io.IOException; import javax.servlet.Filter; import javax.servlet.FilterChain; import javax.servlet.FilterConfig; import javax.servlet.ServletException; import javax.servlet.ServletRequest; import javax.servlet.ServletResponse; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import com.jcxsw.member.vo.MemberUser; public class MemberAuthorityFilter implements Filter { public void destroy() { // TODO Auto-generated method stub } public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { // TODO Auto-generated method stub HttpServletRequest httpReq = (HttpServletRequest) request; HttpServletResponse httpRes = (HttpServletResponse) response; if (request instanceof HttpServletRequest) { MemberUser memberUser = (MemberUser)httpReq.getSession() .getAttribute("memberUser"); <pre><code>if(memberUser == null){ httpRes.sendRedirect(httpReq.getContextPath()+"/member-user/login"); return; } </code></pre> } chain.doFilter(request, response); } public void init(FilterConfig filterConfig) throws ServletException { // TODO Auto-generated method stub } } web.xml CODE <filter-name>MemberAuthorityFilter</filter-name> <filter-class> com.jcxsw.filter.MemberAuthorityFilter </filter-class> </filter> <filter-mapping> <filter-name>MemberAuthorityFilter</filter-name> <url-pattern>/my/*</url-pattern> </filter-mapping>