package com.gci.boot.common.util;

import java.util.regex.Matcher;
import java.util.regex.Pattern;

/**
 * sql注入检查
 * @author chenzw
 * @date 2022/3/30
 */
public final class SqlInjectionCheckUtil {

	private static Pattern pattern = Pattern.compile(
			"\\b(and|exec|insert|select|drop|grant|alter|delete|update|count|chr|mid|master|truncate|char|declare|or)\\b|(;|\\+|'|%)");
	public static boolean containsSqlInjection(Object obj) {
		if(obj == null){
			return false;
		}
		Matcher matcher = pattern.matcher(obj.toString().toLowerCase());
		return matcher.find();
	}

	public static boolean containsSqlInjection(String... sql){
		for(String s : sql){
			if(containsSqlInjection(s)){
				return true;
			}
		}
		return false;
	}

}
