Ajax请求和Filter配合案例解析
案例引入
现在有这样一个问题，就是在提交大片文字评论的时候，前台拿到数据之后给后台发送ajax请求，然后后台有一个防止SQL注入的Filter，这个Filter得到这个前台传过来的数据之后，进行合法性校验，如果没有校验成功，那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。
思路一：请求转发实现
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text':text
},
success:function(data){
//成功之后的逻辑
},
error:function(){
//错误之后的逻辑
}
});
防止SQL注入Filter
packagecom.yiyexiaoyuan.filter;
importjava.io.IOException;
importjava.util.Enumeration;
importjavax.security.auth.message.callback.PrivateKeyCallback.Request;
importjavax.servlet.Filter;
importjavax.servlet.FilterChain;
importjavax.servlet.FilterConfig;
importjavax.servlet.ServletException;
importjavax.servlet.ServletRequest;
importjavax.servlet.ServletResponse;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importnet.sf.json.JSONObject;
//过滤sql关键字的Filter
publicclassSQLFilterimplementsFilter
{
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,
FilterChainchain)throwsIOException,ServletException
{
HttpServletRequestreq=(HttpServletRequest)request;
HttpServletResponseres=(HttpServletResponse)response;
//获得所有请求参数名
Enumerationparams=req.getParameterNames();
Stringsql="";
while(params.hasMoreElements())
{
//得到参数名
Stringname=params.nextElement().toString();
//System.out.println("name==========================="+name+
//"--");
//得到参数对应值
String[]value=req.getParameterValues(name);
for(inti=0;i<value.length;i++)
{
sql=sql+value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串："+sql);
if(sqlValidate(sql))
{
//请求转发
req.getRequestDispatcher("error.jsp").
forward(req,res);
}
else
{
Stringrequest_uri=req.getRequestURI();
chain.doFilter(request,response);
}
}
//校验
protectedstaticbooleansqlValidate(Stringstr)
{
str=str.toLowerCase();//统一转为小写
//StringbadStr="and|exec";
StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
*StringbadStr=
*"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
*+
*"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
*+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*///过滤掉的sql关键字，可以手动添加
String[]badStrs=badStr.split("\\|");
for(inti=0;i<badStrs.length;i++)
{
if(str.indexOf(badStrs[i])!=-1)
{
System.out.println("匹配到："+badStrs[i]);
returntrue;
}
}
returnfalse;
}
publicvoidinit(FilterConfigfilterConfig)throwsServletException
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
publicvoiddestroy()
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
}
web.xml配置
<filter> <display-name>SQLFilter</display-name> <filter-name>SQLFilter</filter-name> <filter-class>com.yiyexiaoyuan.filter.SQLFilter</filter-class> </filter> <filter-mapping> <filter-name>SQLFilter</filter-name> <url-pattern>/servlet/*</url-pattern> </filter-mapping> <filter>
分析，ajax请求DemoServlet，然后请求先被防止SQL注入这个Filter过滤器先过滤，然后过滤到的请求参数构成一个匹配字符串，然后检查是否是恶意代码，如果是的话，请求转发。但是很遗憾，逻辑上这个是对的，但是ajax请求是局部刷新的，最后是要回到ajax请求发起的这个页面的，所以请求转发不会实现，我们看下一种实现逻辑。
思路二：返回值进行判断
这个思路的逻辑是这样的：在Filter过滤掉信息的时候，给ajax请求回送一个json数据，然后返回给前台，前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text':text
},
success:function(data){
//成功之后的逻辑
if(data.mssage!=""){
//执行处理恶意代码的逻辑
}
else{
}
},
error:function(){
//错误之后的逻辑
}
});
防止SQL注入的Filter
packagecom.yiyexiaoyuan.filter;
importjava.io.IOException;
importjava.util.Enumeration;
importjavax.security.auth.message.callback.PrivateKeyCallback.Request;
importjavax.servlet.Filter;
importjavax.servlet.FilterChain;
importjavax.servlet.FilterConfig;
importjavax.servlet.ServletException;
importjavax.servlet.ServletRequest;
importjavax.servlet.ServletResponse;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importnet.sf.json.JSONObject;
//过滤sql关键字的Filter
publicclassSQLFilterimplementsFilter
{
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,
FilterChainchain)throwsIOException,ServletException
{
HttpServletRequestreq=(HttpServletRequest)request;
HttpServletResponseres=(HttpServletResponse)response;
//获得所有请求参数名
Enumerationparams=req.getParameterNames();
Stringsql="";
while(params.hasMoreElements())
{
//得到参数名
Stringname=params.nextElement().toString();
//System.out.println("name==========================="+name+
//"--");
//得到参数对应值
String[]value=req.getParameterValues(name);
for(inti=0;i<value.length;i++)
{
sql=sql+value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串："+sql);
if(sqlValidate(sql))
{
//传送json数据
JSONObjectjson=newJSONObject();
json.accumulate("message","恶意代码注入");
res.getWriter().print(json.toString());
}
else
{
Stringrequest_uri=req.getRequestURI();
chain.doFilter(request,response);
}
}
//校验
protectedstaticbooleansqlValidate(Stringstr)
{
str=str.toLowerCase();//统一转为小写
//StringbadStr="and|exec";
StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
*StringbadStr=
*"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
*+
*"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
*+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*///过滤掉的sql关键字，可以手动添加
String[]badStrs=badStr.split("\\|");
for(inti=0;i<badStrs.length;i++)
{
if(str.indexOf(badStrs[i])!=-1)
{
System.out.println("匹配到："+badStrs[i]);
returntrue;
}
}
returnfalse;
}
publicvoidinit(FilterConfigfilterConfig)throwsServletException
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
publicvoiddestroy()
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
}
思路三：异常+跳转实现
这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话，抛出RuntimeException()，然后导致ajax请求失败，然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢？经过我认真思考之后，我们可以这样做，在session存一个error_messgae值，然后ajax请求的error方法跳转到错误页面，然后进行取值渲染错误页面。
ajax请求
$.ajax({
method:'post',
url:'servlet/DemoServlet',
dataType:'json',
data:{
'userName':userName,
'passWord':passWord,
'text':text
},
success:function(data){
//成功之后的逻辑
},
error:function(){
window.location.href="error.jsp";
}
});
防止SQL注入Filter
packagecom.yiyexiaoyuan.filter;
importjava.io.IOException;
importjava.util.Enumeration;
importjavax.security.auth.message.callback.PrivateKeyCallback.Request;
importjavax.servlet.Filter;
importjavax.servlet.FilterChain;
importjavax.servlet.FilterConfig;
importjavax.servlet.ServletException;
importjavax.servlet.ServletRequest;
importjavax.servlet.ServletResponse;
importjavax.servlet.http.HttpServletRequest;
importjavax.servlet.http.HttpServletResponse;
importnet.sf.json.JSONObject;
//过滤sql关键字的Filter
publicclassSQLFilterimplementsFilter
{
publicvoiddoFilter(ServletRequestrequest,ServletResponseresponse,
FilterChainchain)throwsIOException,ServletException
{
HttpServletRequestreq=(HttpServletRequest)request;
HttpServletResponseres=(HttpServletResponse)response;
//获得所有请求参数名
Enumerationparams=req.getParameterNames();
Stringsql="";
while(params.hasMoreElements())
{
//得到参数名
Stringname=params.nextElement().toString();
//System.out.println("name==========================="+name+
//"--");
//得到参数对应值
String[]value=req.getParameterValues(name);
for(inti=0;i<value.length;i++)
{
sql=sql+value[i];
}
}
System.out.println("提交方式:"+req.getMethod());
System.out.println("被匹配字符串："+sql);
if(sqlValidate(sql))
{
req.getSession().setAttribute("error_message","恶意注入了");
thrownewRuntimeException("恶意注入");
}
else
{
Stringrequest_uri=req.getRequestURI();
chain.doFilter(request,response);
}
}
//校验
protectedstaticbooleansqlValidate(Stringstr)
{
str=str.toLowerCase();//统一转为小写
//StringbadStr="and|exec";
StringbadStr="'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|netuser|xp_cmdshell|or|like|;|--|+|,|*|/";
/*
*StringbadStr=
*"'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
*+
*"information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
*+"chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
*///过滤掉的sql关键字，可以手动添加
String[]badStrs=badStr.split("\\|");
for(inti=0;i<badStrs.length;i++)
{
if(str.indexOf(badStrs[i])!=-1)
{
System.out.println("匹配到："+badStrs[i]);
returntrue;
}
}
returnfalse;
}
publicvoidinit(FilterConfigfilterConfig)throwsServletException
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
publicvoiddestroy()
{
//thrownewUnsupportedOperationException("Notsupportedyet.");
}
}
error.jsp实现
<%@pagelanguage="java"import="java.util.*"pageEncoding="UTF-8"%>
<%@taglibprefix="c"uri="http://java.sun.com/jsp/jstl/core"%>
<%
Stringpath=request.getContextPath();
StringbasePath=request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
%>
<!DOCTYPEHTMLPUBLIC"-//W3C//DTDHTML4.01Transitional//EN">
<html>
<head>
<basehref="<%=basePath%>">
<title>错误页面</title>
<metahttp-equiv="pragma"content="no-cache">
<metahttp-equiv="cache-control"content="no-cache">
<metahttp-equiv="expires"content="0">
<metahttp-equiv="keywords"content="keyword1,keyword2,keyword3">
<metahttp-equiv="description"content="Thisismypage">
<!--
<linkrel="stylesheet"type="text/css"href="styles.css">
-->
</head>
<body>
<center>
系统出错了，请稍后再试......
<br/>
<br/>
<br/>
<br/>
错误信息是:${error_message}
</center>
</body>
</html>
这样就很巧妙得实现了Filter拦截并友好提示。
以上所述是小编给大家介绍的Ajax请求和Filter配合案例解析，希望对大家有所帮助，如果大家有任何疑问请给我留言，小编会及时回复大家的。在此也非常感谢大家对毛票票网站的支持！