Java

Java RSS

filtering bad user input

•

Join Date: Mar 2004

Posts: 7

Reputation: Dave G. is an unknown quantity at this point

Solved Threads: 0

Dave G.

Offline

Newbie Poster

filtering bad user input

Nov 2nd, 2004

I am trying to set up a jsp page which takes input from any form and filters out user input which may pose a security risk. I am using the following function to try to do this:

 Help with Code Tags 
 Java Syntax (Toggle Plain Text) 
 
<%!
private String checkInput(String test){
String bad_input = "";
boolean someBadInput = false;
char[] bad_characters = {'<','>','\'','\"','*','#','=','&','\\',';',':'};
int number_of_bad_characters = 11;
int i;
for(i=0; i<number_of_bad_characters; i++){
if(test.indexOf(bad_characters[i]) != -1){
if(!someBadInput){
	bad_input += bad_characters[i];
	someBadInput = true;
}else{
	if(i < (number_of_bad_characters-1)){
	 bad_input += ", "+ bad_characters[i];
	}else{
	 bad_input += ", and "+ bad_characters[i];
	}
}
}
}
if(someBadInput){
return bad_input;
}else{
return "good";
}
}
%>
 
<%!
private String checkInput(String test){
String bad_input = "";
boolean someBadInput = false;
char[] bad_characters = {'<','>','\'','\"','*','#','=','&','\\',';',':'};
int number_of_bad_characters = 11;
int i;
for(i=0; i<number_of_bad_characters; i++){
if(test.indexOf(bad_characters[i]) != -1){
if(!someBadInput){
	bad_input += bad_characters[i];
	someBadInput = true;
}else{
	if(i < (number_of_bad_characters-1)){
	 bad_input += ", "+ bad_characters[i];
	}else{
	 bad_input += ", and "+ bad_characters[i];
	}
}
}
}
if(someBadInput){
return bad_input;
}else{
return "good";
}
}
%>

I get a null pointer from the following line:

 Help with Code Tags 
 Java Syntax (Toggle Plain Text) 
 if(test.indexOf(bad_characters[i]) != -1){
 if(test.indexOf(bad_characters[i]) != -1){

Been working at the computer for too long and going kinda bugeyed - so any other eyes that check this out are much appreciated!

Thanks in advance,
Dave.

•