java--仿sql注入--sql过滤器

/** * SQL过滤 * * @author zhugl * @email Abracadabra@gmail.com * @date 2018-04-20  15:38 */public class SQLFilter {    /**     * SQL注入过滤     *     * @param str 待验证的字符串     */    public static String sqlInject(String str) {        if (StringUtils.isBlank(str)) {            return null;        }        //去掉'|"|;|\字符        str = StringUtils.replace(str, "'", "");        str = StringUtils.replace(str, "\"", "");        str = StringUtils.replace(str, ";", "");        str = StringUtils.replace(str, "\\", "");        //转换成小写        str = str.toLowerCase();        //非法字符        String[] keywords = {"master", "truncate", "insert", "select", "delete", "update", "declare", "alert", "drop"};        //判断是否包含非法字符        for (String keyword : keywords) {            if (str.indexOf(keyword) != -1) {                throw new RRException("包含非法字符");            }        }        return str;    }}