java 使用拦截器防止XSS和sql攻击代码

在Java中，使用拦截器（Interceptor）来防止XSS（跨站脚本攻击）和SQL注入通常是在Web应用服务器如Spring MVC或者MyBatis等框架中。这里提供一种基于Spring AOP（Aspect Oriented Programming）的基本思想：

**防止XSS攻击：**

import org.aspectj.lang.annotation.Aspect;
import org.aspectj.lang.annotation.Before;
import org.springframework.stereotype.Component;

@Aspect
@Component
public class XSSFilter {

    @Before("execution(* com.yourpackage.web.service.*.*(..))")
    public void preventXss(JoinPoint joinPoint) {
        Object request = joinPoint.getArgs()[0]; // 假设第一个参数是HTTP请求
        if (request instanceof ServletRequest) {
            HttpServletRequest req = (HttpServletRequest) request;
            String userInput = req.getParameter("inputParam");
            // 对用户输入进行校验和转义
            req.setAttribute("inputParam", sanitizeInput(userInput));
        }
    }

    private String sanitizeInput(String input) {
        // 使用过滤器库（如Apache Commons Lang或OWASP ESAPI）进行XSS转义处理
        return org.apache.commons.lang.StringEscapeUtils.escapeHtml4(input);
    }
}

**防止SQL注入：**

import org.aspectj.lang.ProceedingJoinPoint;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.stereotype.Component;

@Aspect
@Component
public class SqlInjectionFilter {

    @Around("execution(* com.yourpackage.repository.jdbc.*.*(..)) && args(sqlQuery)")
    public Object preventSqlInjection(ProceedingJoinPoint joinPoint, Object sqlQuery) throws Throwable {
        String sanitizedQuery = filterAndSanitizeSql((String) sqlQuery);
        JdbcTemplate jdbcTemplate = (JdbcTemplate) joinPoint.getTarget();
        return jdbcTemplate.query(sanitizedQuery, joinPoint.getArgs());
    }

    private String filterAndSanitizeSql(String query) {
        // 使用PreparedStatement避免SQL注入
        return "SELECT * FROM your_table WHERE column = ?"; // 或者使用预编译查询
    }
}