like模糊查詢%注入問題

android like 全局模糊查找文件命名 通過條件通過 like %search%

如果查找的關鍵字是% 那么就成了 like %%% 就會查找出所有的文件

解決辦法是先把正則里面的匹配符 替換成轉義字符

    private static String sqliteEscape(String keyWord) {
        keyWord = keyWord.replace("/", "//");
        keyWord = keyWord.replace("'", "''");
        keyWord = keyWord.replace("[", "/[");
        keyWord = keyWord.replace("]", "/]");
        keyWord = keyWord.replace("%", "/%");
        keyWord = keyWord.replace("&", "/&");
        keyWord = keyWord.replace("_", "/_");
        keyWord = keyWord.replace("(", "/(");
        keyWord = keyWord.replace(")", "/)");
        return keyWord;
    }

這個時候 還需要 告訴sql語句那個字符是轉義的 需用到 escape "/"替換轉義字符

    public static void fileSearch(Context context, String inputString) {
        String searchTxt = sqliteEscape(inputString);
        ContentResolver contentResolver = context.getContentResolver();
        String[] projection = {MediaStore.Files.FileColumns._ID, MediaStore.Files.FileColumns.DATA,
                MediaStore.Files.FileColumns.DATE_MODIFIED,
                MediaStore.Files.FileColumns.SIZE, MediaStore.Files.FileColumns.TITLE,
                MediaStore.Files.FileColumns.MIME_TYPE};
        String selection = MediaStore.Files.FileColumns.TITLE + " LIKE ? escape '/' ";
        String searchStr = "%"+searchTxt+"%";
        String[] selectionArgs = new String[]{searchStr};
        Cursor cursor = null;
        try {
            cursor = contentResolver.query(MediaStore.Files.getContentUri("external"), projection, selection, selectionArgs, MediaStore.Files.FileColumns.DATE_MODIFIED + " desc");
            if (cursor != null) {
                int fileId;
                String filePath;
                File file;
                long size;
                long modifiedTime;
                while (cursor.moveToNext()) {
                    //....
                }
            }
        } catch (Exception e) {
            if (DEBUG) {
                Log.e(TAG, "", e);
            }
        } finally {
            try {
                if (cursor != null) {
                    cursor.close();
                }
            } catch (Exception e) {
                if (DEBUG) {
                    Log.e(TAG, "", e);
                }
            }
        }
    }