All geek questions in one place

Lib to protect SQL / javascript input for java / jsp

Does anyone know of a good lib where I can run lines before inserting them, which could strip sql / javascript code? To run in jsp pages.

The idealism of lib would be:

  • Free
  • A light weight
  • Ease of use

Thanks in advance to the SO community, who will happily respond :)

+2
source share
7 answers

Apache Commons lang StringEscapeUtils will bring you part of the path. He slips away, does not separate.

http://commons.apache.org/lang/api/org/apache/commons/lang/StringEscapeUtils.html

: Escaping , , , , , .

+5

api . sql , , . .

: , , , . sql . .

javascript, , . , , , SO, . , .

+4

AntiSamy OWASP. , , . Java, , .

+2

, , , "" . , , , .

, , :) api - :)

0

c: out XML. , - , , , .

0

SQL, PreparedStatement. - , , PreparedStatement. HTML JavaScript, . XML. JSTL escapeXml, fn tld.

0

, :

OP SQL JavaScript.

SQL Injection , , / . Java PMD ( PMD) Findbugs ( Findbugs ) SQL-. OWASP SQL- Java.

As for the script injection, the safest way to prevent hacked scripts from running is to ensure that user input, when used as output, should be displayed using a coded format - for web applications, this will be HTML encoding . This OWASP page shows you how to perform HTML encoding in Java.

0
source

Source: https://habr.com/ru/post/1774522/

More articles:


All Articles