Servlet表单输入验证：确保数据完整性的后端策略

import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.PreparedStatement;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class UserRegistrationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest req, HttpServletResponse res)
            throws ServletException, IOException {
        res.setContentType("text/html");
        PrintWriter pw = res.getWriter();

        // 获取表单参数
        String uName = req.getParameter("username");
        String pWord = req.getParameter("password");
        String fName = req.getParameter("firstname");
        String lName = req.getParameter("lastname");
        String addr = req.getParameter("address");
        String phNo = req.getParameter("phone");
        String mailId = req.getParameter("mailid");

        // 后端验证逻辑
        StringBuilder errorMessages = new StringBuilder();

        if (uName == null || uName.trim().isEmpty() || uName.trim().length() < 3) {
            errorMessages.append("用户名不能为空且至少3个字符。<br/>");
        }
        if (pWord == null || pWord.trim().isEmpty() || pWord.trim().length() < 8 ||
            !pWord.matches("(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}")) {
            errorMessages.append("密码不能为空，且必须包含至少8个字符，包括大小写字母和数字。<br/>");
        }
        if (fName == null || fName.trim().isEmpty() || fName.trim().length() < 3) {
            errorMessages.append("姓氏不能为空且至少3个字符。<br/>");
        }
        if (lName == null || lName.trim().isEmpty() || lName.trim().length() < 3) {
            errorMessages.append("名字不能为空且至少3个字符。<br/>");
        }
        // 其他字段的验证...
        if (mailId == null || mailId.trim().isEmpty() || !mailId.matches("[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$")) {
            errorMessages.append("邮箱格式不正确。<br/>");
        }

        // 如果存在错误信息，则停止处理并返回错误提示
        if (errorMessages.length() > 0) {
            RequestDispatcher rd = req.getRequestDispatcher("Sample.html"); // 返回到注册页面
            rd.include(req, res);
            pw.println("<h3 class='tab' style='color:red;'>注册失败！请检查以下问题：</h3>");
            pw.println("<p class='tab' style='color:red;'>" + errorMessages.toString() + "</p>");
            return; // 终止后续处理
        }

        // 如果所有验证通过，则执行数据库操作
        try {
            Connection con = DBConnection.getCon(); // 假设DBConnection是一个数据库连接工具类
            PreparedStatement ps = con
                    .prepareStatement("INSERT INTO " + IUserContants.TABLE_USERS + " (username, password, firstname, lastname, address, phone, mailid, user_role) VALUES (?,?,?,?,?,?,?,?)");
            ps.setString(1, uName.trim()); // 使用trim()去除首尾空白
            ps.setString(2, pWord.trim());
            ps.setString(3, fName.trim());
            ps.setString(4, lName.trim());
            ps.setString(5, addr != null ? addr.trim() : ""); // 确保非空字段处理
            ps.setString(6, phNo != null ? phNo.trim() : "");
            ps.setString(7, mailId.trim());
            ps.setInt(8, 2); // 假设用户角色默认为2

            int k = ps.executeUpdate();

            if (k == 1) {
                RequestDispatcher rd = req.getRequestDispatcher("Sample.html");
                rd.include(req, res);
                pw.println("<h3 class='tab' style='color:green;'>用户注册成功！</h3>");
            } else {
                RequestDispatcher rd = req.getRequestDispatcher("Sample.html");
                rd.include(req, res);
                pw.println("<h3 class='tab' style='color:red;'>注册失败！请稍后再试。</h3>");
            }
        } catch (Exception e) {
            e.printStackTrace();
            RequestDispatcher rd = req.getRequestDispatcher("Sample.html");
            rd.include(req, res);
            pw.println("<h3 class='tab' style='color:red;'>服务器内部错误，注册失败！</h3>");
        } finally {
            // 关闭数据库资源（Connection, PreparedStatement等）
            // 这是一个简化示例，实际应用中应在finally块中安全关闭资源
        }
    }
}