Package org.owasp.esapi
Class PreparedString
- java.lang.Object
-
- org.owasp.esapi.PreparedString
-
public class PreparedString extends java.lang.Object
A parameterized string that uses escaping to make untrusted data safe before combining it with a command or query intended for use in an interpreter.PreparedString div = new PreparedString( "<a href=\"http:\\\\example.com?id=?\" onmouseover=\"alert('?')\">test</a>", new HTMLEntityCodec() ); div.setURL( 1, request.getParameter( "url" ), new PercentCodec() ); div.set( 2, request.getParameter( "message" ), new JavaScriptCodec() ); out.println( div.toString() ); // escaping for SQL PreparedString query = new PreparedString( "SELECT * FROM users WHERE name='?' AND password='?'", new OracleCodec() ); query.set( 1, request.getParameter( "name" ) ); query.set( 2, request.getParameter( "pass" ) ); stmt.execute( query.toString() );
- Since:
- June 1, 2007
- Author:
- Jeff Williams (jeff.williams .at. aspectsecurity.com) Aspect Security
-
-
Constructor Summary
Constructors Constructor Description PreparedString(java.lang.String template, char parameterCharacter, Codec codec)
Create a PreparedString with the supplied template, parameter placeholder character, and Codec.PreparedString(java.lang.String template, Codec codec)
Create a PreparedString with the supplied template and Codec.
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description void
set(int index, java.lang.String value)
Set the parameter at index with supplied value using the default Codec to escape.void
set(int index, java.lang.String value, Codec codec)
Set the parameter at index with supplied value using the supplied Codec to escape.java.lang.String
toString()
Render the PreparedString by combining the template with properly escaped parameters.
-
-
-
Constructor Detail
-
PreparedString
public PreparedString(java.lang.String template, Codec codec)
Create a PreparedString with the supplied template and Codec. The template should use the default parameter placeholder character (?) in the place where actual parameters are to be inserted. The supplied Codec will be used to escape characters in calls to set, unless a specific Codec is provided to override it.- Parameters:
template
-codec
-
-
PreparedString
public PreparedString(java.lang.String template, char parameterCharacter, Codec codec)
Create a PreparedString with the supplied template, parameter placeholder character, and Codec. The parameter character can be any character, but should not be one that will be used in the template. The parameter character can safely be used in a parameter passed into the set methods.- Parameters:
template
-parameterCharacter
-codec
-
-
-
Method Detail
-
set
public void set(int index, java.lang.String value)
Set the parameter at index with supplied value using the default Codec to escape.- Parameters:
index
-value
-
-
set
public void set(int index, java.lang.String value, Codec codec)
Set the parameter at index with supplied value using the supplied Codec to escape.- Parameters:
index
-value
-codec
-
-
toString
public java.lang.String toString()
Render the PreparedString by combining the template with properly escaped parameters.- Overrides:
toString
in classjava.lang.Object
-
-