Session應用之---防止表單重複提交

客戶端防止（採用JavaScript阻止方式）：

PS：防得住君子，防不了小人

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
  <head>
    <title>防表單重複提交</title>
	
    <meta http-equiv="keywords" content="keyword1,keyword2,keyword3">
    <meta http-equiv="description" content="this is my page">
    <meta http-equiv="content-type" content="text/html; charset=UTF-8">
    
    <!--<link rel="stylesheet" type="text/css" href="./styles.css">-->

	<script type="text/javascript">
		/*
		var iscommitted = false;
		function dosubmit(){
			if(!iscommitted){
				iscommitted = true;
				return true;
			}else{
				return false;
			}
			
		}
		*/
		function dosubmit(){
			document.getElementById("submit").disabled = 'disabled';
			return true;
		}
		
	</script>

  </head>
  
  <body>
    <form action="/day07/servlet/FormSubmitServlet" method="post" οnsubmit="return dosubmit()">
    	用戶名：<input type="text" name="username"><br/>
    	<input id="submit" type="submit" value="提交">
    </form>
  </body>
</html>

服務器端防止：

表單頁面由servlet程序生成，servlet爲每次產生的表單頁面分配一個唯一的隨機標識號，並在FORM表單的一個隱藏字段中設置這個標識號，同時在當前用戶的Session域中保存這個標識號。
當用戶提交FORM表單時，負責處理表單提交的serlvet得到表單提交的標識號，並與session中存儲的標識號比較，如果相同則處理表單提交，處理完後清除當前用戶的Session域中存儲的標識號。
在下列情況下，服務器程序將拒絕用戶提交的表單請求：
1，存儲Session域中的表單標識號與表單提交的標識號不同
2，當前用戶的Session中不存在表單標識號
3，用戶提交的表單數據中沒有標識號字段

產生表單：

package cn.itcast.form;

import java.io.IOException;
import java.io.PrintWriter;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Random;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import sun.misc.BASE64Encoder;
//產生表單
public class FormServlet extends HttpServlet {

	public void doGet(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {

		response.setContentType("text/html;charset=UTF-8");
		response.setCharacterEncoding("UTF-8");
		PrintWriter  out = response.getWriter();
		
		
		String token = TokenProcessor.getInstance().generateToken();
		request.getSession().setAttribute("token", token);
		
		out.print("<form action='/day07/servlet/FormSubmitServlet' method='post'>");
			out.print("<input type='hidden' name='token' value='"+token+"'>");
			out.print("<input type='text' name='username'>");
			out.print("<input type='submit' value='提交'>");
		out.print("</form>");
		
		
	}

	public void doPost(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		doGet(request, response);
	}
}

class TokenProcessor{
	//1.  把構造方法私有
	//2.  自己產生一個類的對象
	//3.  定義一個方法返回上面產生的對象
	
	private TokenProcessor(){};
	public static final TokenProcessor instance = new TokenProcessor();
	public static TokenProcessor getInstance(){
		return instance;
	}
	
	public String generateToken(){
		
		//3843849384   9849238402840243802  983434
		String token = System.currentTimeMillis() + "" + new Random().nextInt(99999999);
		
		//數據指紋 數據摘要  md5
		try {
			MessageDigest md = MessageDigest.getInstance("md5"); 
			byte md5[] = md.digest(token.getBytes());   //128位  16個字節【12，23，34，544543543543，】
			
			//base64編碼    SABDSSDSD
			BASE64Encoder encoder = new BASE64Encoder();
			return encoder.encode(md5);


		} catch (NoSuchAlgorithmException e) {
			throw new RuntimeException(e);
		}
	}
}

檢驗是否重複提交：

package cn.itcast.form;

import java.io.IOException;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class FormSubmitServlet extends HttpServlet {

	public void doGet(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {

		boolean b = isToken(request);
		if(!b){
			//用戶帶過來的令牌無效，阻止提交
			System.out.println("你是重複提交！！");
			return;
		}
		
		//用戶帶過來的令牌有效，處理提交
		request.getSession().removeAttribute("token");
		
		String username = request.getParameter("username");
		//把用戶提交的數據保存到數據庫中
		System.out.println("處理提交請求，把" + username + "保存到數庫中！！");
		
	}

	//判斷用戶帶過來的令牌是否有效
	private synchronized boolean isToken(HttpServletRequest request) {
		String client_token = request.getParameter("token");
		if(client_token==null){
			return false;
		}
		
		String server_token = (String) request.getSession().getAttribute("token");
		if(server_token==null){
			return false;
		}
		
		if(!client_token.equals(server_token)){
			return false;
		}
		
		return true;
	}

	public void doPost(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		doGet(request, response);
	}

}