JAVAWEB项目处理XSS漏洞攻击处理方案

对页面传入的参数值进行过滤，过滤方法如下

/**
	 * 将容易引起xss漏洞的半角字符直接替换成全角字符
	 * 
	 * @param s
	 * @return
	 */
	public static  String xssEncode(String s) {
		if (s == null || s.equals("")) {
			return s;
		}
		try {
			s = URLDecoder.decode(s, UTF8);
		} catch (UnsupportedEncodingException e) {
			e.printStackTrace();
		}
		//< > ' " \ / # & 
		s = s.replaceAll("<", "<").replaceAll(">", ">");  
		s = s.replaceAll("\\(", "(").replaceAll("\\)", ")");  
		s = s.replaceAll("'", "'");  
		s = s.replaceAll("eval\\((.*)\\)", "");  
		s = s.replaceAll("[\\\"\\\'][\\s]*javascript:(.*)[\\\"\\\']", "\"\"");  
		s = s.replaceAll("script", "");
		s = s.replaceAll("#", "＃");
		s = s.replaceAll("%", "％");
		return s;
	}