Java Regex保护xSS

Question

I want to use java Regex to check whether there is <script/> in my url. I want to match if characters of url occur in ['"&<>\\/] , But for java ,the regex is little different, I do not know how to write correct regex to match. Can someone can help me?

Answer 1

Never do Html Encoding/Decoding/Validation yourself. If you ever encounter code that is manually validating html, xml etc... it is a bug. Always use a library that is well used and peer reviewed for these sorts of tasks. Don't be a cowboy coder and think you can do it well; it is much harder to get right than you might think. The OWASP site has everything you need to know about how to do this in JAVA.

Answer 2

How are you displaying the query string parameter? If you are doing this in a JSP file you can simply use the <c:out> tag to escape it:

<%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<c:out value="${param.myUnsafeParam}" />