Java 正则表达式，小于和大于符号
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5644006/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Java Regex, less than and more than sign
提问by Dech
I have a string that users are able to enter on the internet, currently it is not protected against XSS attacks. I would like to be able to replace < and > symbols. Commonly known as 'less than', 'more than', 'angle brackets' etc.
我有一个用户可以在互联网上输入的字符串，目前它不受 XSS 攻击的保护。我希望能够替换 < 和 > 符号。俗称“小于”、“大于”、“尖括号”等。
I am sure this has been asked a million times but I can't find a simple answer. I assume regex is the way forward but can't work out how to pick these characters.
我相信这已经被问了一百万次，但我找不到一个简单的答案。我认为正则表达式是前进的方向，但无法弄清楚如何选择这些字符。
回答by WhiteFang34
You really should use StringEscapeUtils.escapeHtml()from Apache Commons Langto instead of regex for this. E.g. all you need to do is:
为此，您确实应该使用StringEscapeUtils.escapeHtml()from Apache Commons Langto 而不是正则表达式。例如，您需要做的就是：
String escaped = StringEscapeUtils.escapeHtml(input);
The best practice to protect against XSS is to escape all HTML entities and this method handles those cases for you. Otherwise you'll be writing, testing and maintaining your own code to do what has already been done. See the OWASP XSS (Cross Site Scripting) Prevention Cheat Sheetfor more details.
防止 XSS 的最佳做法是转义所有 HTML 实体，此方法会为您处理这些情况。否则，您将编写、测试和维护自己的代码来完成已经完成的工作。有关更多详细信息，请参阅OWASP XSS（跨站点脚本）预防备忘单。
回答by Travis Webb
Java regex shouldn't require any special treatment for angle brackets. This should work fine:
Java regex 不需要对尖括号进行任何特殊处理。这应该可以正常工作：
myString.replace("<", "less than").replace(">", "greater than");
Hope that helps.
希望有帮助。
-tjw
-tjw
回答by KP Taylor
As an alternative to regex, you can use a utility class like the Apache Commons StringEscapeUtilsclass to encode your HTML strings when they are posted back to the server and before storing them in the databse or re-sending them as output.
作为正则表达式的替代方案，您可以使用实用程序类（如 Apache Commons StringEscapeUtils类）在 HTML 字符串回发到服务器时以及将它们存储在数据库中或将它们作为输出重新发送之前对其进行编码。
回答by BalusC
Since you tagged this jsp, I'd like to add that the normal approach to escape HTML/XML in JSP is using the JSTL<c:out>tag or fn:escapeXml()function.
由于您标记了这个jsp，我想补充一点，在 JSP 中转义 HTML/XML 的正常方法是使用JSTL<c:out>标记或fn:escapeXml()函数。
E.g.
例如
<c:out value="${user.name}" />
<input type="text" name="name" value="${fn:escapeXml(user.name)}" />
No need for Apache Commons Lang. Plus, escaping should really be done in the view side, not in the model/controller side.
不需要 Apache Commons Lang。另外，转义应该在视图端完成，而不是在模型/控制器端。
