/b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)/b|(/*|;|/+|'|%)

/** * 是否含有sql注入，返回true表示含有 * @param obj * @return */public static boolean containsSqlInjection(Object obj){  Pattern pattern= Pattern.compile("//b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)//b|(//*|;|//+|'|%)");  Matcher matcher=pattern.matcher(obj.toString());  return matcher.find();}

@Testpublic void testContainsSqlInjection(){  boolean b1=SqlUtils.containsSqlInjection("and nm=1");  assertEquals("b1不為true",true,b1);  boolean b2=SqlUtils.containsSqlInjection("niamsh delete from ");  assertEquals("b2不為true",true,b2);  boolean b3=SqlUtils.containsSqlInjection("stand");  assertEquals("b3不為false",false,b3);  boolean b4=SqlUtils.containsSqlInjection("and");  assertEquals("b4不為true",true,b4);  boolean b5=SqlUtils.containsSqlInjection("niasdm%asjdj");  assertEquals("b5不為true",true,b5);}