Java WEB安全问题及解决方案

httpResponse.setHeader("Cache-Control","no-cache");   
httpResponse.setHeader("Cache-Control","no-store");  
httpResponse.setDateHeader("Expires", 0);  
httpResponse.setHeader("Pragma","no-cache");  

String sql= “SELECT * FROM USERS WHERE 1=1”;  
if(null != user.getUserName() && !””.equals(user.getUserName())){  
    sql += “ and UNAME = ‘”+user.getUserName()+”’”;  
}  

PreparedStatement pstmt = con.prepareStatement("SELECT * FROM USERS WHERE UNAME=?");  
pstmt.setString(1, “Neeke”);  

List result = session.createQuery(queryString)  
                  .setString("name", user.getUserName())  
                  .list();  

@RequestMapping(params="method=addTopic",method=RequestMethod.POST)  
public ModelAndView addTopic(HttpServletRequest request, HttpServletResponse response, BbsTopic topic)  
{  
    BaseAdmin user = (BaseAdmin) request.getSession().getAttribute(Constant.SESSION_USER);  
    topic.setBaseAdmin(user);  
    topic.setTopicDate(new Timestamp(System.currentTimeMillis()));  
    topic.setTopicContent(StringEscapeUtils.escapeHtml(topic.getTopicContent()));  
    topic.setTopicTitle(StringEscapeUtils.escapeHtml(topic.getTopicTitle()));  
    this.bbsTopicService.save(topic);  
    return new ModelAndView(new RedirectView("bbs.do?method=topicList&bfid="+ topic.getBfid()));  
}