SafeSql.java

出自ProgWiki

用途

• 自組SQL命令字串時，避免帶入的參數導致SQL資料隱碼。

程式碼

package com.data.toolkit;
 
//import java.lang.StringBuffer;
 
public final class SafeSql
{
	public static String Quote(String strData)
	{
		StringBuffer sb = new StringBuffer();
		sb.append("'");
 
		if (strData != null)
		{
			char [] src = strData.toCharArray();
 
			for(int i=0; i<src.length; i++)
			{
		        	if(String.valueOf(src[i]).equals("'"))
		       		{
		    	   		sb.append("''");
		       		}
		       		else
		       		{
		    	   		sb.append(src[i]);
		       		}
			}
		}
		sb.append("'");
		return sb.toString();
	}
 
	public static String QuoteLike(String strData)
	{
		StringBuffer sb = new StringBuffer();
		sb.append("'%");
 
		if (strData != null)
		{
			char [] src = strData.toCharArray();
 
			for(int i=0; i<src.length; i++)
			{
		       		if(String.valueOf(src[i]).equals("'"))
		       		{
		    	   		sb.append("''");
		       		}
		       		else
		       		{
		    	   		sb.append(src[i]);
		       		}
			}
			sb.append("%'");
		}
		else
		{
			sb.append("'");
		}
		return sb.toString();
	}
 
	public static String QuoteLikeRight(String strData)
	{
		StringBuffer sb = new StringBuffer();
		sb.append("'");
 
		if (strData != null)
		{
			char [] src = strData.toCharArray();
 
			for(int i=0; i<src.length; i++)
			{
		       		if(String.valueOf(src[i]).equals("'"))
		       		{
		    	   		sb.append("''");
		       		}
		       		else
		       		{
		    	   		sb.append(src[i]);
		       		}
			}
		}
		sb.append("%'");
 
		return sb.toString();		
	}
 
	public static String QuoteLikeLeft(String strData)
	{
		StringBuffer sb = new StringBuffer();
		sb.append("'%");
 
		if (strData != null)
		{
			char [] src = strData.toCharArray();
 
			for(int i=0; i<src.length; i++)
			{
		       		if(String.valueOf(src[i]).equals("'"))
		       		{
		    	   		sb.append("''");
		       		}
		       		else
		       		{
		    	   		sb.append(src[i]);
		       		}
			}
		}
		sb.append("'");
 
		return sb.toString();
	}
 
	public static String NoQuote(String strData)
	{
		StringBuffer sb = new StringBuffer();
 
		if (strData != null)
		{
			char [] src = strData.toCharArray();
 
			for(int i=0; i<src.length; i++)
			{
		       		if(String.valueOf(src[i]).equals("'"))
		       		{
		    	   		sb.append("''");
		       		}
		       		else
		       		{
		    	   		sb.append(src[i]);
		       		}
			}
		}
		return sb.toString();
	}
 
	public static String in(Object[] array)
	{
		StringBuffer sb = new StringBuffer();
		if (array != null)
		{
			sb.append('(');
			for (int i = 0; i < array.length; i++)
			{
				if (i > 0)
					sb.append(',');
				Object o = array[i];		
				sb.append(o);					
			}
			sb.append(')');
		}
		return sb.toString();
	}
}