JAVA 安全性轉碼代碼（包括sql注入，跨站腳本）

例子：

column_type = SecurityString.getHtml(column_type);
column_type = SecurityString.getValidSQLPara(column_type);

實現：

 1     public class SecurityString {  
 2       
 3         public static String getHtml(String str) {  
 4             //過濾敏感字符  
 5             str = filter(str);  
 6             if (str != null) {  
 7                 return str.replaceAll("\r\n", "<BR>");  
 8             } else {  
 9                 return " ";  
10             }  
11         }  
12         /**  
13          * 防止跨站腳本攻擊  
14          * 過濾敏感字符  
15          * 將HTML特殊字符轉換爲相應的實體字符。  
16          */  
17         public static String filter(String value) {  
18       
19             if (value == null || value.length() == 0) {  
20                 return value;  
21             }  
22       
23             StringBuffer result = null;  
24             String filtered = null;  
25             for (int i = 0; i < value.length(); i++) {  
26                 filtered = null;  
27                 switch (value.charAt(i)) {  
28                     case '<' :  
29                         filtered = "<";  
30                         break;  
31                     case '>' :  
32                         filtered = ">";  
33                         break;  
34                     case '&' :  
35                         filtered = "&";  
36                         break;  
37                     case '"' :  
38                         filtered = """;  
39                         break;  
40                     case '\'' :  
41                         filtered = "'";  
42                         break;  
43                 }  
44       
45                 if (result == null) {  
46                     if (filtered != null) {  
47                         result = new StringBuffer(value.length() + 50);  
48                         if (i > 0) {  
49                             result.append(value.substring(0, i));  
50                         }  
51                         result.append(filtered);  
52                     }  
53                 } else {  
54                     if (filtered == null) {  
55                         result.append(value.charAt(i));  
56                     } else {  
57                         result.append(filtered);  
58                     }  
59                 }  
60             }  
61             return result == null ? value : result.toString();  
62         }  
63         /**  
64          * 防止SQL注入  
65          * 驗證字符類型不能包含特殊字  
66          */  
67         public static boolean checkNonlicetCharacters(String string) {  
68             boolean flag = true;  
69             // 不準出現單引號  
70             if (string != null && string.indexOf("'") > 0) {  
71                 flag = false;  
72             }  
73       
74             return flag;  
75         }  
76         /**  
77          * 防止SQL注入  
78          */  
79         public static String getValidSQLPara(String string) {  
80             if (string == null || string.length() == 0) {  
81                 return string;  
82             }  
83             return string.replaceAll("'", "''");  
84         }  
85       
86     }