4: <%
5: String u=request.getParameter("username");
6: String p=request.getParameter("password");
7: if (a.sql_inj(u) || a.sql_inj(p))
8: out.println("123");
9: Connection conn=DriverManager.getConnection("jdbc:odbc:mysql","sa","syl");
10: Statement sm=conn.createStatement();
Stacktrace:
org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:568)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:470)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:403)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:347)
javax.servlet.http.HttpServlet.service(HttpServlet.java:725)
org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
------------------------------------------------------------------
D:\MyWeb\WEB-INF\classes\StringUtil\sql_inj.class javaBean 存放目录
-------------------------sql_inj.java 内容----------------------
package StringUtil;
public class sql_inj{
public static boolean sql_inj(String str)
{
String inj_str = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+|,";
String inj_stra[] = inj_str.split("|");
for (int i=0 ; i
if (str.indexOf(inj_stra[i])>=0)
{
return true;
}
}
return false;
}
}
-------------------------我想实现的功能是过滤SQL