like模糊查询%注入问题

android like 全局模糊查找文件命名 通过条件通过 like %search%

如果查找的关键字是% 那么就成了 like %%% 就会查找出所有的文件

解决办法是先把正则里面的匹配符 替换成转义字符

    private static String sqliteEscape(String keyWord) {
        keyWord = keyWord.replace("/", "//");
        keyWord = keyWord.replace("'", "''");
        keyWord = keyWord.replace("[", "/[");
        keyWord = keyWord.replace("]", "/]");
        keyWord = keyWord.replace("%", "/%");
        keyWord = keyWord.replace("&", "/&");
        keyWord = keyWord.replace("_", "/_");
        keyWord = keyWord.replace("(", "/(");
        keyWord = keyWord.replace(")", "/)");
        return keyWord;
    }

这个时候 还需要 告诉sql语句那个字符是转义的 需用到 escape "/"替换转义字符

    public static void fileSearch(Context context, String inputString) {
        String searchTxt = sqliteEscape(inputString);
        ContentResolver contentResolver = context.getContentResolver();
        String[] projection = {MediaStore.Files.FileColumns._ID, MediaStore.Files.FileColumns.DATA,
                MediaStore.Files.FileColumns.DATE_MODIFIED,
                MediaStore.Files.FileColumns.SIZE, MediaStore.Files.FileColumns.TITLE,
                MediaStore.Files.FileColumns.MIME_TYPE};
        String selection = MediaStore.Files.FileColumns.TITLE + " LIKE ? escape '/' ";
        String searchStr = "%"+searchTxt+"%";
        String[] selectionArgs = new String[]{searchStr};
        Cursor cursor = null;
        try {
            cursor = contentResolver.query(MediaStore.Files.getContentUri("external"), projection, selection, selectionArgs, MediaStore.Files.FileColumns.DATE_MODIFIED + " desc");
            if (cursor != null) {
                int fileId;
                String filePath;
                File file;
                long size;
                long modifiedTime;
                while (cursor.moveToNext()) {
                    //....
                }
            }
        } catch (Exception e) {
            if (DEBUG) {
                Log.e(TAG, "", e);
            }
        } finally {
            try {
                if (cursor != null) {
                    cursor.close();
                }
            } catch (Exception e) {
                if (DEBUG) {
                    Log.e(TAG, "", e);
                }
            }
        }
    }