How to check certain words on a string?

Question

    if (c.getQuery().contains("update") || c.getQuery().contains("delete") || c.getQuery().contains("truncate")
            || c.getQuery().contains("drop")) {
        throw new MensagemException(Mensagens.getMensagem("Only select is allowed"));

I have this simple code, that checks the string query. But it only checks lower case, what can I do to make it also verify any upper case without writing this over and over?

@Dimitri that wouldn't work because the OP's intent is not to compare the whole string — Juan Carlos Mendoza, Oct 06 '17 at 13:35
This question duplicate https://stackoverflow.com/questions/17134773/to-check-if-string-contains-particular-word and https://stackoverflow.com/questions/86780/how-to-check-if-a-string-contains-another-string-in-a-case-insensitive-manner-in — , Oct 06 '17 at 13:41
Also just to note: if your query will be by any chance something like: `select date_updated from tableA` you will get a false positive... — P.An, Oct 06 '17 at 13:42
Have you considered handling user grants in your DB instead of this? — Juan Carlos Mendoza, Oct 06 '17 at 13:42
@John C why you putting same question again and again, By changing It's contains logic differently? You must search for help before putting you question over stackoverflow. — , Oct 06 '17 at 13:48

Mureinik · Answer 1 · 2017-10-06T13:36:54.873

3

Java strings don't have a containsIgnoreCase method, unfortunately. One way around this is to convert your input to lower case (or upper case, take your pick), and check it for the lower case words you're searching:

String toSearch = c.getQuery().toLowerCase();
if (toSearch.contains("update") || 
    toSearch.contains("delete") || 
    toSearch.contains("truncate") || 
    toSearch.contains("drop")) {
        throw new MensagemException
            (Mensagens.getMensagem("Only select is allowed"));
}

edited Oct 06 '17 at 13:36

answered Oct 06 '17 at 13:35

Mureinik

297,002
52
306
350

I believe this answer is just wrong. The question is surely an XY problem example; you don't check if a SQL query is a select by using a 'contains' on other SQL key words. This answer will break as soon as any field from the table contains one of those strings (e.g. select updated_on from mytable); at best you could use startsWith and assume only one query is being executed but trying to solve "how do I detect a non-select SQL query" is surely the actual question rather than what they have proposed. – adamcooney Oct 06 '17 at 13:56

score 0 · Answer 2 · answered Oct 06 '17 at 13:36

I'd do a few enhancements:

final String cQuery = c.getQuery(); // retrieve only once
// check null, convert query to lower case so case won't matter anymore
final String cQueryLower = cQuery == null ? null : cQuery.toLowerCase();
if (cQueryLower.contains("update") || cQueryLower.contains("delete") || cQueryLower.contains("truncate") || cQueryLower.contains("drop")) {
    throw new MensagemException(Mensagens.getMensagem("Only select is allowed"));
}

You could try this too: if (!cQueryLower.contains("select"))

score 0 · Answer 3 · answered Oct 06 '17 at 13:37

You could use toLowerCase() so you can check all variants of uppercase and lowercase with lowercase

if (c.getQuery().toLowerCase().contains("update") || c.getQuery().toLowerCase().contains("delete") || c.getQuery().toLowerCase().contains("truncate")
            || c.getQuery().toLowerCase().contains("drop")) {
        throw new MensagemException(Mensagens.getMensagem("Only select is allowed"));

I mean it must work like this. I have not tested it

score 0 · Answer 4 · edited Oct 06 '17 at 14:10

you can transform your string to lower case and then keep the same thing you are doing, should be like this :

String queryToLowerCase = c.getQuery().toLowerCase();
if (queryToLowerCase .contains("update") || queryToLowerCase .contains("delete") 
      || queryToLowerCase .contains("truncate") || queryToLowerCase .contains("drop")) {
    throw new MensagemException(Mensagens.getMensagem("Only select is allowed"));

How to check certain words on a string?

4 Answers4