当前位置：Gxlcms > PHP教程 > Ajax请求和Filter配合案例详解

Ajax请求和Filter配合案例详解

时间：2021-07-01 10:21:17 帮助过：23人阅读

本文主要介绍了Ajax请求和Filter配合案例解析的,本文给大家介绍的非常详细，具有参考借鉴加载，需要的朋友可以参考下，希望能帮助到大家。

案例引入

现在有这样一个问题，就是在提交大片文字评论的时候，前台拿到数据之后给后台发送ajax请求，然后后台有一个防止SQL注入的Filter，这个Filter得到这个前台传过来的数据之后，进行合法性校验，如果没有校验成功，那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。

思路一：请求转发实现

ajax请求

  1. $.ajax({
  2. method:'post',
  3. url:'servlet/DemoServlet',
  4. dataType:'json',
  5. data:{
  6. 'userName':userName,
  7. 'passWord':passWord,
  8. 'text': text
  9. },
  10. success:function(data){
  11. //成功之后的逻辑
  12. },
  13. error:function(){
  14. //错误之后的逻辑
  15. }
  16. });

防止SQL注入Filter

  1. package com.yiyexiaoyuan.filter;
  2. import java.io.IOException;
  3. import java.util.Enumeration;
  4. import javax.security.auth.message.callback.PrivateKeyCallback.Request;
  5. import javax.servlet.Filter;
  6. import javax.servlet.FilterChain;
  7. import javax.servlet.FilterConfig;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.ServletRequest;
  10. import javax.servlet.ServletResponse;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import net.sf.json.JSONObject;
  14. //过滤sql关键字的Filter 
  15. public class SQLFilter implements Filter
  16. {
  17. public void doFilter(ServletRequest request, ServletResponse response,
  18. FilterChain chain) throws IOException, ServletException
  19. {
  20. HttpServletRequest req = (HttpServletRequest) request;
  21. HttpServletResponse res = (HttpServletResponse) response;
  22. // 获得所有请求参数名
  23. Enumeration params = req.getParameterNames();
  24. String sql = "";
  25. while (params.hasMoreElements())
  26. {
  27. // 得到参数名
  28. String name = params.nextElement().toString();
  29. // System.out.println("name===========================" + name +
  30. // "--");
  31. // 得到参数对应值
  32. String[] value = req.getParameterValues(name);
  33. for (int i = 0; i < value.length; i++)
  34. {
  35. sql = sql + value[i];
  36. } 
  37. }
  38. System.out.println("提交方式:"+req.getMethod());
  39. System.out.println("被匹配字符串：" + sql);
  40. if (sqlValidate(sql))
  41. {
  42. //请求转发
  43. req.getRequestDispatcher("error.jsp").
  44. forward(req, res); 
  45. }
  46. else
  47. {
  48. String request_uri = req.getRequestURI(); 
  49. chain.doFilter(request, response);
  50. }
  51. }
  52. // 校验
  53. protected static boolean sqlValidate(String str)
  54. {
  55. str = str.toLowerCase();// 统一转为小写
  56. // String badStr = "and|exec";
  57. String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
  58. /*
  59. * String badStr =
  60. * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
  61. * +
  62. * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
  63. * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
  64. */// 过滤掉的sql关键字，可以手动添加
  65. String[] badStrs = badStr.split("\\|");
  66. for (int i = 0; i < badStrs.length; i++)
  67. {
  68. if (str.indexOf(badStrs[i]) != -1)
  69. {
  70. System.out.println("匹配到：" + badStrs[i]);
  71. return true;
  72. }
  73. }
  74. return false;
  75. }
  76. public void init(FilterConfig filterConfig) throws ServletException
  77. {
  78. // throw new UnsupportedOperationException("Not supported yet.");
  79. }
  80. public void destroy()
  81. {
  82. // throw new UnsupportedOperationException("Not supported yet.");
  83. }
  84. }

web.xml配置

  1. <filter>
  2. <display-name>SQLFilter</display-name>
  3. <filter-name>SQLFilter</filter-name>
  4. <filter-class>com.yiyexiaoyuan.filter.SQLFilter</filter-class>
  5. </filter>
  6. <filter-mapping>
  7. <filter-name>SQLFilter</filter-name>
  8. <url-pattern>/servlet/*</url-pattern>
  9. </filter-mapping>
  10. <filter>

分析，ajax请求DemoServlet，然后请求先被防止SQL注入这个Filter过滤器先过滤，然后过滤到的请求参数构成一个匹配字符串，然后检查是否是恶意代码，如果是的话，请求转发。但是很遗憾，逻辑上这个是对的，但是ajax请求是局部刷新的，最后是要回到ajax请求发起的这个页面的，所以请求转发不会实现，我们看下一种实现逻辑。

思路二：返回值进行判断

这个思路的逻辑是这样的：在Filter过滤掉信息的时候，给ajax请求回送一个json数据，然后返回给前台，前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。

ajax请求

  1. $.ajax({
  2. method:'post',
  3. url:'servlet/DemoServlet',
  4. dataType:'json',
  5. data:{
  6. 'userName':userName,
  7. 'passWord':passWord,
  8. 'text': text
  9. },
  10. success:function(data){
  11. //成功之后的逻辑
  12. if (data.mssage!=""){
  13. //执行处理恶意代码的逻辑
  14. }
  15. else{
  16. }
  17. },
  18. error:function(){
  19. //错误之后的逻辑
  20. }
  21. });

防止SQL注入的Filter

  1. package com.yiyexiaoyuan.filter;
  2. import java.io.IOException;
  3. import java.util.Enumeration;
  4. import javax.security.auth.message.callback.PrivateKeyCallback.Request;
  5. import javax.servlet.Filter;
  6. import javax.servlet.FilterChain;
  7. import javax.servlet.FilterConfig;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.ServletRequest;
  10. import javax.servlet.ServletResponse;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import net.sf.json.JSONObject;
  14. //过滤sql关键字的Filter 
  15. public class SQLFilter implements Filter
  16. {
  17. public void doFilter(ServletRequest request, ServletResponse response,
  18. FilterChain chain) throws IOException, ServletException
  19. {
  20. HttpServletRequest req = (HttpServletRequest) request;
  21. HttpServletResponse res = (HttpServletResponse) response;
  22. // 获得所有请求参数名
  23. Enumeration params = req.getParameterNames();
  24. String sql = "";
  25. while (params.hasMoreElements())
  26. {
  27. // 得到参数名
  28. String name = params.nextElement().toString();
  29. // System.out.println("name===========================" + name +
  30. // "--");
  31. // 得到参数对应值
  32. String[] value = req.getParameterValues(name);
  33. for (int i = 0; i < value.length; i++)
  34. {
  35. sql = sql + value[i];
  36. } 
  37. }
  38. System.out.println("提交方式:"+req.getMethod());
  39. System.out.println("被匹配字符串：" + sql);
  40. if (sqlValidate(sql))
  41. {
  42. //传送json数据
  43. JSONObject json = new JSONObject();
  44. json.accumulate("message", "恶意代码注入");
  45. res.getWriter().print(json.toString()); 
  46. }
  47. else
  48. {
  49. String request_uri = req.getRequestURI(); 
  50. chain.doFilter(request, response);
  51. }
  52. }
  53. // 校验
  54. protected static boolean sqlValidate(String str)
  55. {
  56. str = str.toLowerCase();// 统一转为小写
  57. // String badStr = "and|exec";
  58. String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
  59. /*
  60. * String badStr =
  61. * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
  62. * +
  63. * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
  64. * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
  65. */// 过滤掉的sql关键字，可以手动添加
  66. String[] badStrs = badStr.split("\\|");
  67. for (int i = 0; i < badStrs.length; i++)
  68. {
  69. if (str.indexOf(badStrs[i]) != -1)
  70. {
  71. System.out.println("匹配到：" + badStrs[i]);
  72. return true;
  73. }
  74. }
  75. return false;
  76. }
  77. public void init(FilterConfig filterConfig) throws ServletException
  78. {
  79. // throw new UnsupportedOperationException("Not supported yet.");
  80. }
  81. public void destroy()
  82. {
  83. // throw new UnsupportedOperationException("Not supported yet.");
  84. }
  85. }

思路三：异常+跳转实现

这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话，抛出RuntimeException()，然后导致ajax请求失败，然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢？经过我认真思考之后，我们可以这样做，在session存一个error_messgae值，然后ajax请求的error方法跳转到错误页面，然后进行取值渲染错误页面。

ajax请求

  1. $.ajax({
  2. method:'post',
  3. url:'servlet/DemoServlet',
  4. dataType:'json',
  5. data:{
  6. 'userName':userName,
  7. 'passWord':passWord,
  8. 'text': text
  9. },
  10. success:function(data){
  11. //成功之后的逻辑
  12. },
  13. error:function(){
  14. window.location.href="error.jsp";
  15. }
  16. });

防止SQL注入Filter

  1. package com.yiyexiaoyuan.filter;
  2. import java.io.IOException;
  3. import java.util.Enumeration;
  4. import javax.security.auth.message.callback.PrivateKeyCallback.Request;
  5. import javax.servlet.Filter;
  6. import javax.servlet.FilterChain;
  7. import javax.servlet.FilterConfig;
  8. import javax.servlet.ServletException;
  9. import javax.servlet.ServletRequest;
  10. import javax.servlet.ServletResponse;
  11. import javax.servlet.http.HttpServletRequest;
  12. import javax.servlet.http.HttpServletResponse;
  13. import net.sf.json.JSONObject;
  14. //过滤sql关键字的Filter 
  15. public class SQLFilter implements Filter
  16. {
  17. public void doFilter(ServletRequest request, ServletResponse response,
  18. FilterChain chain) throws IOException, ServletException
  19. {
  20. HttpServletRequest req = (HttpServletRequest) request;
  21. HttpServletResponse res = (HttpServletResponse) response;
  22. // 获得所有请求参数名
  23. Enumeration params = req.getParameterNames();
  24. String sql = "";
  25. while (params.hasMoreElements())
  26. {
  27. // 得到参数名
  28. String name = params.nextElement().toString();
  29. // System.out.println("name===========================" + name +
  30. // "--");
  31. // 得到参数对应值
  32. String[] value = req.getParameterValues(name);
  33. for (int i = 0; i < value.length; i++)
  34. {
  35. sql = sql + value[i];
  36. } 
  37. }
  38. System.out.println("提交方式:"+req.getMethod());
  39. System.out.println("被匹配字符串：" + sql);
  40. if (sqlValidate(sql))
  41. {
  42. req.getSession().setAttribute("error_message","恶意注入了"); 
  43. throw new RuntimeException("恶意注入");
  44. }
  45. else
  46. {
  47. String request_uri = req.getRequestURI(); 
  48. chain.doFilter(request, response);
  49. }
  50. }
  51. // 校验
  52. protected static boolean sqlValidate(String str)
  53. {
  54. str = str.toLowerCase();// 统一转为小写
  55. // String badStr = "and|exec";
  56. String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";
  57. /*
  58. * String badStr =
  59. * "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"
  60. * +
  61. * "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"
  62. * + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";
  63. */// 过滤掉的sql关键字，可以手动添加
  64. String[] badStrs = badStr.split("\\|");
  65. for (int i = 0; i < badStrs.length; i++)
  66. {
  67. if (str.indexOf(badStrs[i]) != -1)
  68. {
  69. System.out.println("匹配到：" + badStrs[i]);
  70. return true;
  71. }
  72. }
  73. return false;
  74. }
  75. public void init(FilterConfig filterConfig) throws ServletException
  76. {
  77. // throw new UnsupportedOperationException("Not supported yet.");
  78. }
  79. public void destroy()
  80. {
  81. // throw new UnsupportedOperationException("Not supported yet.");
  82. }
  83. }

error.jsp实现

  1. <%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%>
  2. <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
  3. <%
  4. String path = request.getContextPath();
  5. String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";
  6. %>
  7. <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
  8. <html>
  9. <head>
  10. <base href="<%=basePath%>">
  11. <title>错误页面</title>
  12. <meta http-equiv="pragma" content="no-cache">
  13. <meta http-equiv="cache-control" content="no-cache">
  14. <meta http-equiv="expires" content="0"> 
  15. <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
  16. <meta http-equiv="description" content="This is my page">
  17. <!--
  18. <link rel="stylesheet" type="text/css" href="styles.css">
  19. -->
  20. </head>
  21. <body>
  22. <center> 
  23. 系统出错了，请稍后再试......
  24. <br />
  25. <br />
  26. <br />
  27. <br />
  28. 错误信息是: ${ error_message}
  29. </center> 
  30. </body>
  31. </html>

这样就很巧妙得实现了Filter拦截并友好提示。

相关推荐：

ajax的简单应用和filter的编写方法

jQuery中find()和filter()操作用法实例详解

CSS3中filter(滤镜)属性详解

以上就是Ajax请求和Filter配合案例详解的详细内容，更多请关注Gxl网其它相关文章！

人气教程排行

本站所有资源全部来源于网络，若本站发布的内容侵害到您的隐私或者利益，请联系我们删除！