jose-m
10/20/2017 - 2:45 PM

SQL INJECTION

EXPRESION REGULAR PARA PREVENIR SQL INJECTION

public static String cleanQuery(String value) {
        if(value != "") {
            value = value.replaceAll("", "");
            Pattern scriptPattern = Pattern.compile("('(''|[^'])*')|(;)|(\\b(AND|OR|LIKE|WHERE|FROM|ALTER|CREATE|DELETE|DROP|EXEC(UTE){0,1}|INSERT( +INTO){0,1}|MERGE|SELECT|UPDATE|UNION( +ALL){0,1})\\b)", Pattern.CASE_INSENSITIVE);
            value = scriptPattern.matcher(value).replaceAll("");
		}
		return value;
	}