JAVA 安全性转码代码（包括sql注入，跨站脚本）

例子：

column_type = SecurityString.getHtml(column_type);
column_type = SecurityString.getValidSQLPara(column_type);

实现：

 1     public class SecurityString {
 2
 3         public static String getHtml(String str) {
 4             //过滤敏感字符
 5             str = filter(str);
 6             if (str != null) {
 7                 return str.replaceAll("\r\n", "<BR>");
 8             } else {
 9                 return " ";
10             }
11         }
12         /**
13          * 防止跨站脚本攻击
14          * 过滤敏感字符
15          * 将HTML特殊字符转换为相应的实体字符。
16          */
17         public static String filter(String value) {
18
19             if (value == null || value.length() == 0) {
20                 return value;
21             }
22
23             StringBuffer result = null;
24             String filtered = null;
25             for (int i = 0; i < value.length(); i++) {
26                 filtered = null;
27                 switch (value.charAt(i)) {
28                     case ‘<‘ :
29                         filtered = "<";
30                         break;
31                     case ‘>‘ :
32                         filtered = ">";
33                         break;
34                     case ‘&‘ :
35                         filtered = "&";
36                         break;
37                     case ‘"‘ :
38                         filtered = """;
39                         break;
40                     case ‘\‘‘ :
41                         filtered = "‘";
42                         break;
43                 }
44
45                 if (result == null) {
46                     if (filtered != null) {
47                         result = new StringBuffer(value.length() + 50);
48                         if (i > 0) {
49                             result.append(value.substring(0, i));
50                         }
51                         result.append(filtered);
52                     }
53                 } else {
54                     if (filtered == null) {
55                         result.append(value.charAt(i));
56                     } else {
57                         result.append(filtered);
58                     }
59                 }
60             }
61             return result == null ? value : result.toString();
62         }
63         /**
64          * 防止SQL注入
65          * 验证字符类型不能包含特殊字
66          */
67         public static boolean checkNonlicetCharacters(String string) {
68             boolean flag = true;
69             // 不许出现单引号
70             if (string != null && string.indexOf("‘") > 0) {
71                 flag = false;
72             }
73
74             return flag;
75         }
76         /**
77          * 防止SQL注入
78          */
79         public static String getValidSQLPara(String string) {
80             if (string == null || string.length() == 0) {
81                 return string;
82             }
83             return string.replaceAll("‘", "‘‘");
84         }
85
86     }