Ajax请求和Filter配合的示例分析

这篇文章主要为大家展示了"Ajax请求和Filter配合的示例分析"，内容简而易懂，条理清晰，希望能够帮助大家解决疑惑，下面让小编带领大家一起研究并学习一下"Ajax请求和Filter配合的示例分析"这篇文章吧。

案例引入

现在有这样一个问题，就是在提交大片文字评论的时候，前台拿到数据之后给后台发送ajax请求，然后后台有一个防止SQL注入的Filter，这个Filter得到这个前台传过来的数据之后，进行合法性校验，如果没有校验成功，那么要跳转到error.jsp页面进行显示错误信息。现在让我们看看怎么实现这个需求。

思路一：请求转发实现

ajax请求

$.ajax({method:'post',url:'servlet/DemoServlet',dataType:'json',data:{'userName':userName,'passWord':passWord,'text': text},success:function(data){//成功之后的逻辑},error:function(){//错误之后的逻辑}});

防止SQL注入Filter

package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException{HttpServletRequest req = (HttpServletRequest) request;HttpServletResponse res = (HttpServletResponse) response;// 获得所有请求参数名Enumeration params = req.getParameterNames();String sql = "";while (params.hasMoreElements()){// 得到参数名String name = params.nextElement().toString();// System.out.println("name===========================" + name +// "--");// 得到参数对应值String[] value = req.getParameterValues(name);for (int i = 0; i < value.length; i++){sql = sql + value[i];} }System.out.println("提交方式:"+req.getMethod());System.out.println("被匹配字符串：" + sql);if (sqlValidate(sql)){//请求转发req.getRequestDispatcher("error.jsp").forward(req, res); }else{String request_uri = req.getRequestURI(); chain.doFilter(request, response);}}// 校验protected static boolean sqlValidate(String str){str = str.toLowerCase();// 统一转为小写// String badStr = "and|exec";String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";/** String badStr =* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"* +* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";*/// 过滤掉的sql关键字，可以手动添加String[] badStrs = badStr.split("\\|");for (int i = 0; i < badStrs.length; i++){if (str.indexOf(badStrs[i]) != -1){System.out.println("匹配到：" + badStrs[i]);return true;}}return false;}public void init(FilterConfig filterConfig) throws ServletException{// throw new UnsupportedOperationException("Not supported yet.");}public void destroy(){// throw new UnsupportedOperationException("Not supported yet.");}}

web.xml配置

SQLFilterSQLFiltercom.yiyexiaoyuan.filter.SQLFilterSQLFilter/servlet/*

分析，ajax请求DemoServlet，然后请求先被防止SQL注入这个Filter过滤器先过滤，然后过滤到的请求参数构成一个匹配字符串，然后检查是否是恶意代码，如果是的话，请求转发。但是很遗憾，逻辑上这个是对的，但是ajax请求是局部刷新的，最后是要回到ajax请求发起的这个页面的，所以请求转发不会实现，我们看下一种实现逻辑。

思路二：返回值进行判断

这个思路的逻辑是这样的：在Filter过滤掉信息的时候，给ajax请求回送一个json数据，然后返回给前台，前台拿这个数据进行判断是否是恶意代码和良好代码。再进行下一步的处理。

ajax请求

$.ajax({method:'post',url:'servlet/DemoServlet',dataType:'json',data:{'userName':userName,'passWord':passWord,'text': text},success:function(data){//成功之后的逻辑if (data.mssage!=""){//执行处理恶意代码的逻辑}else{}},error:function(){//错误之后的逻辑}});

防止SQL注入的Filter

package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException{HttpServletRequest req = (HttpServletRequest) request;HttpServletResponse res = (HttpServletResponse) response;// 获得所有请求参数名Enumeration params = req.getParameterNames();String sql = "";while (params.hasMoreElements()){// 得到参数名String name = params.nextElement().toString();// System.out.println("name===========================" + name +// "--");// 得到参数对应值String[] value = req.getParameterValues(name);for (int i = 0; i < value.length; i++){sql = sql + value[i];} }System.out.println("提交方式:"+req.getMethod());System.out.println("被匹配字符串：" + sql);if (sqlValidate(sql)){//传送json数据JSONObject json = new JSONObject();json.accumulate("message", "恶意代码注入");res.getWriter().print(json.toString()); }else{String request_uri = req.getRequestURI(); chain.doFilter(request, response);}}// 校验protected static boolean sqlValidate(String str){str = str.toLowerCase();// 统一转为小写// String badStr = "and|exec";String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";/** String badStr =* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"* +* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";*/// 过滤掉的sql关键字，可以手动添加String[] badStrs = badStr.split("\\|");for (int i = 0; i < badStrs.length; i++){if (str.indexOf(badStrs[i]) != -1){System.out.println("匹配到：" + badStrs[i]);return true;}}return false;}public void init(FilterConfig filterConfig) throws ServletException{// throw new UnsupportedOperationException("Not supported yet.");}public void destroy(){// throw new UnsupportedOperationException("Not supported yet.");}}

思路三：异常+跳转实现

这个思路的逻辑是这样的。后台的Filter过滤掉恶意注入代码的话，抛出RuntimeException()，然后导致ajax请求失败，然后回调ajax请求的error方法。但是我们错误页面的数据怎么传送过去呢？经过我认真思考之后，我们可以这样做，在session存一个error_messgae值，然后ajax请求的error方法跳转到错误页面，然后进行取值渲染错误页面。

ajax请求

$.ajax({method:'post',url:'servlet/DemoServlet',dataType:'json',data:{'userName':userName,'passWord':passWord,'text': text},success:function(data){//成功之后的逻辑},error:function(){_window.location.href="error.jsp";}});

防止SQL注入Filter

package com.yiyexiaoyuan.filter;import java.io.IOException;import java.util.Enumeration;import javax.security.auth.message.callback.PrivateKeyCallback.Request;import javax.servlet.Filter;import javax.servlet.FilterChain;import javax.servlet.FilterConfig;import javax.servlet.ServletException;import javax.servlet.ServletRequest;import javax.servlet.ServletResponse;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import net.sf.json.JSONObject;//过滤sql关键字的Filter public class SQLFilter implements Filter{public void doFilter(ServletRequest request, ServletResponse response,FilterChain chain) throws IOException, ServletException{HttpServletRequest req = (HttpServletRequest) request;HttpServletResponse res = (HttpServletResponse) response;// 获得所有请求参数名Enumeration params = req.getParameterNames();String sql = "";while (params.hasMoreElements()){// 得到参数名String name = params.nextElement().toString();// System.out.println("name===========================" + name +// "--");// 得到参数对应值String[] value = req.getParameterValues(name);for (int i = 0; i < value.length; i++){sql = sql + value[i];} }System.out.println("提交方式:"+req.getMethod());System.out.println("被匹配字符串：" + sql);if (sqlValidate(sql)){req.getSession().setAttribute("error_message","恶意注入了"); throw new RuntimeException("恶意注入");}else{String request_uri = req.getRequestURI(); chain.doFilter(request, response);}}// 校验protected static boolean sqlValidate(String str){str = str.toLowerCase();// 统一转为小写// String badStr = "and|exec";String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|chr|mid|master|truncate|char|declare|sitename|net user|xp_cmdshell|or|like|;|--|+|,|*|/";/** String badStr =* "'|and|exec|execute|insert|create|drop|table|from|grant|use|group_concat|column_name|"* +* "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|"* + "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";*/// 过滤掉的sql关键字，可以手动添加String[] badStrs = badStr.split("\\|");for (int i = 0; i < badStrs.length; i++){if (str.indexOf(badStrs[i]) != -1){System.out.println("匹配到：" + badStrs[i]);return true;}}return false;}public void init(FilterConfig filterConfig) throws ServletException{// throw new UnsupportedOperationException("Not supported yet.");}public void destroy(){// throw new UnsupportedOperationException("Not supported yet.");}}

error.jsp实现

<%@ page language="java" import="java.util.*" pageEncoding="UTF-8"%><%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %><%String path = request.getContextPath();String basePath = request.getScheme()+"://"+request.getServerName()+":"+request.getServerPort()+path+"/";%>  系统出错了，请稍后再试......



错误信息是: ${ error_message} 

这样就很巧妙得实现了Filter拦截并友好提示。

以上是"Ajax请求和Filter配合的示例分析"这篇文章的所有内容，感谢各位的阅读！相信大家都有了一定的了解，希望分享的内容对大家有所帮助，如果还想学习更多知识，欢迎关注行业资讯频道！