java--仿sql注入--sql過濾器

/** * SQL過濾 * * @author zhugl * @email Abracadabra@gmail.com * @date 2018-04-20  15:38 */public class SQLFilter {    /**     * SQL注入過濾     *     * @param str 待驗證的字符串     */    public static String sqlInject(String str) {        if (StringUtils.isBlank(str)) {            return null;        }        //去掉'|"|;|\字符        str = StringUtils.replace(str, "'", "");        str = StringUtils.replace(str, "\"", "");        str = StringUtils.replace(str, ";", "");        str = StringUtils.replace(str, "\\", "");        //轉換成小寫        str = str.toLowerCase();        //非法字符        String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alert", "drop"};        //判斷是否包含非法字符        for (String keyword : keywords) {            if (str.indexOf(keyword) != -1) {                throw new RRException("包含非法字符");            }        }        return str;    }}