xssProject在java web项目中应用
- - Java - 编程语言 - ITeye博客1.项目引入xssProtect-0.1.jar、antlr-3.0.1.jar、antlr-runtime-3.0.1.jar包. * 覆盖getParameter方法,将参数名和参数值都做xss过滤. * 如果需要获得原始的值,则通过super.getParameterValues(name)来获取
.
.
CREATE TABLE `timeline_raw` ( `rawId` bigint(20) NOT NULL AUTO_INCREMENT, `uid` bigint(20) DEFAULT NULL, `did` bigint(20) DEFAULT NULL, `channelId` char(1) NOT NULL DEFAULT '1' COMMENT '1:qvga; 2:720p', `fileId` bigint(20) DEFAULT NULL, `sectionId` bigint(20) DEFAULT NULL, `headerFilePath` varchar(120) DEFAULT NULL, `startTime` bigint(20) DEFAULT NULL, `endTime` bigint(20) DEFAULT NULL, `updateTime` datetime DEFAULT NULL, `createTime` datetime DEFAULT NULL, PRIMARY KEY (`rawId`), KEY `index_uid_did_startTime` (`uid`,`did`,`startTime`) USING BTREE, KEY `index_uid_did_endTime` (`uid`,`did`,`endTime`) USING BTREE, KEY `index_time` (`startTime`) USING BTREE, KEY `index_uid_did_fileId` (`uid`,`did`,`sectionId`) USING BTREE, KEY `index_sectionId` (`sectionId`) ) ENGINE=InnoDB AUTO_INCREMENT=1 DEFAULT CHARSET=utf8 |
<select id="getRawFileList" parameterClass="java.util.HashMap" resultClass="com.defonds.mysql.raw.entity.TimelineRaw"> SELECT * FROM timeline_raw_ WHERE uid=#uid# AND did=#did# AND channelId=#channelId# <isNotNull property="sectionId"> AND sectionId = #sectionId#</isNotNull> AND ( (startTime BETWEEN #startTime# and #endTime#) OR (endTime BETWEEN #startTime# and #endTime#) OR ( <![CDATA[ startTime<=#startTime# ]]> AND <![CDATA[ endTime>=#endTime# ]]> ) ) ORDER BY startTime; </select> |