|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
java.lang.Object org.owasp.esapi.PreparedString
public class PreparedString
A parameterized string that uses escaping to make untrusted data safe before combining it with a command or query intended for use in an interpreter.
PreparedString div = new PreparedString( "<a href=\"http:\\\\example.com?id=?\" onmouseover=\"alert('?')\">test</a>", new HTMLEntityCodec() ); div.setURL( 1, request.getParameter( "url" ), new PercentCodec() ); div.set( 2, request.getParameter( "message" ), new JavaScriptCodec() ); out.println( div.toString() ); // escaping for SQL PreparedString query = new PreparedString( "SELECT * FROM users WHERE name='?' AND password='?'", new OracleCodec() ); query.set( 1, request.getParameter( "name" ) ); query.set( 2, request.getParameter( "pass" ) ); stmt.execute( query.toString() );
Constructor Summary | |
---|---|
PreparedString(java.lang.String template,
char parameterCharacter,
Codec codec)
Create a PreparedString with the supplied template, parameter placeholder character, and Codec. |
|
PreparedString(java.lang.String template,
Codec codec)
Create a PreparedString with the supplied template and Codec. |
Method Summary | |
---|---|
void |
set(int index,
java.lang.String value)
Set the parameter at index with supplied value using the default Codec to escape. |
void |
set(int index,
java.lang.String value,
Codec codec)
Set the parameter at index with supplied value using the supplied Codec to escape. |
java.lang.String |
toString()
Render the PreparedString by combining the template with properly escaped parameters. |
Methods inherited from class java.lang.Object |
---|
clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait |
Constructor Detail |
---|
public PreparedString(java.lang.String template, Codec codec)
template
- codec
- public PreparedString(java.lang.String template, char parameterCharacter, Codec codec)
template
- parameterCharacter
- codec
- Method Detail |
---|
public void set(int index, java.lang.String value)
index
- value
- public void set(int index, java.lang.String value, Codec codec)
index
- value
- codec
- public java.lang.String toString()
toString
in class java.lang.Object
|
||||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |