sqlfilter.java

来自「cwbbs 云网论坛源码」· Java 代码 · 共 102 行

package cn.js.fan.db;

public class SQLFilter {
    public SQLFilter() {
    }

    
    public static String getCountSql(String query) {
        
        query = query.toLowerCase();
        int begin = query.indexOf(" from ");
        String query_part = query.substring(begin, query.length()).trim();
        
        int d = -1;
        d = query_part.indexOf(" order by");
        if (d != -1)
            query_part = query_part.substring(0, d);
        

        
        d = query.indexOf(" distinct ");
        String distinct = ""; 
        if (d != -1) {
            int nextspace = query.indexOf(" ", d + 10);
            if (nextspace > d) {
                distinct = query.substring(d + 10, nextspace);
            }
        }

        
        

        if (distinct.equals(""))
            query = "select count(*) " + query_part;
        else
            query = "select count(distinct " + distinct + ") " + query_part;
        
        return query;

    }

    
    public static boolean sql_inj(String str) {
        
        
        String inj_str = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|-|+|,";
        String inj_stra[] = inj_str.split("\\|");
        for (int i = 0; i < inj_stra.length; i++) {
            if (str.indexOf(inj_stra[i]) >= 0) {
                return true;
            }
        }
        return false;
    }

    
    public static boolean isValidSqlParam(String param) {
        return !sql_inj(param.toLowerCase());
    }

    public static boolean isValidSql(String sql) {
        if (sql.toLowerCase().indexOf(";delete") != -1) 
            return false;
        return true;
    }

    public static String sqlstr(String str) {
        if (str == null || (str.trim()).equals("")) {
            str = "\'\'";
            return str;
        }
        str = "\'" + replace(str, "\'", "\'\'") + "\'";
        return str;
    }

    
    public static String getFromSql(String query) {
        query = query.toLowerCase();
        int begin = query.indexOf(" from ");
        String query_part = query.substring(begin, query.length()).trim();
        return query_part;
    }

    public static String replace(String strSource, String strFrom, String strTo) {
        if (strSource.equals("") || strSource == null)
            return strSource;
        String strDest = "";
        int intFromLen = strFrom.length();
        int intPos;
        if (strSource == null || (strSource.trim()).equals(""))
            return strSource;
        while ((intPos = strSource.indexOf(strFrom)) != -1) {
            strDest = strDest + strSource.substring(0, intPos);
            strDest = strDest + strTo;
            strSource = strSource.substring(intPos + intFromLen);
        }
        strDest = strDest + strSource;

        return strDest;
    }
}