SQL Injection Attacks and Defense - 2009

Validating Input in Java
Code-Level Defenses • Chapter 8 353
In Java, input validation support is specific to the framework being used. To demonstrate
input validation in Java, we will look at how a common framework for building Web
applications in Java, Java Server Faces (JSF), provides support for input validation. For this
purpose, the best way to implement input validation is to define an input validation class that
implements the javax.faces.validator.Validator interface. Refer for the following code snippet for
an example of validating a username in JSF:
public class UsernameValidator implements Validator {
public void validate(FacesContext facesContext,
UIComponent uIComponent, Object value) throws ValidatorException
{
}
//Get supplied username and cast to a String
String username = (String)value;
//Set up regular expression
Pattern p = Pattern.compile("^[a-zA-Z]{8,12}$");
//Match username
Matcher m = p.matcher(username);
if (!matchFound) {
}
FacesMessage message = new FacesMessage();
message.setDetail("Not valid – it must be 8–12 letter only");
message.setSummary("Username not valid");
message.setSeverity(FacesMessage.SEVERITY_ERROR);
throw new ValidatorException(message);
And the following will need to be added to the faces-config.xml file in order to enable
the above validator:
namespace.UsernameValidator
namespace.package.UsernameValidator
You can then refer to this in the related JSP file as follows: