Servlet 客户端 HTTP 请求
HttpServletRequest 读取请求行、请求头、Cookie 与参数的方法。
Key Points请求行用 getMethod/getRequestURI/getQueryString 读，请求头用 getHeader，参数用 getParameter。
请求行
| Method | Returns |
|---|---|
| getMethod() | GET / POST / ... |
| getRequestURI() | /myapp/hello |
| getQueryString() | name=Ada&age=20 |
| getProtocol() | HTTP/1.1 |
| getContextPath() | /myapp |
| getServletPath() | /hello |
请求头
Java
@WebServlet("/headers")
public class HeaderServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp)
throws IOException {
resp.setContentType("text/plain;charset=UTF-8");
try (PrintWriter out = resp.getWriter()) {
out.println("User-Agent : " + req.getHeader("User-Agent"));
out.println("Accept : " + req.getHeader("Accept"));
out.println("Host : " + req.getHeader("Host"));
out.println("Lang : " + req.getHeader("Accept-Language"));
out.println("--- 全部请求头 ---");
Enumeration<String> names = req.getHeaderNames();
while (names.hasMoreElements()) {
String n = names.nextElement();
out.println(n + " = " + req.getHeader(n));
}
}
}
}getHeader is case-insensitive, so getHeader("user-agent") equals getHeader("User-Agent"). When a header repeats, use getHeaders(name) to get all values.
读取 Cookie
Java
Cookie[] cookies = req.getCookies();
if (cookies != null) {
for (Cookie c : cookies) {
System.out.println(c.getName() + " = " + c.getValue());
}
}安全地取参数
Java
private static String param(HttpServletRequest req, String key, String dflt) {
String v = req.getParameter(key);
return (v == null || v.isBlank()) ? dflt : v.trim();
}
private static int intParam(HttpServletRequest req, String key, int dflt) {
try {
return Integer.parseInt(param(req, key, String.valueOf(dflt)));
} catch (NumberFormatException e) {
return dflt;
}
}Never concatenate a
getParameter value into SQL or HTML — that is injection or XSS. Parameters are untrusted input and must go through prepared statements and escaping.请求行
| 方法 | 返回 |
|---|---|
| 请求方法 | GET / POST / ... |
| 请求路径 | /myapp/hello |
| 原始查询串 | name=Ada&age=20 |
| 协议版本 | HTTP/1.1 |
| 应用上下文 | /myapp |
| Servlet 路径 | /hello |
请求头
Java
@WebServlet("/headers")
public class HeaderServlet extends HttpServlet {
@Override
protected void doGet(HttpServletRequest req, HttpServletResponse resp)
throws IOException {
resp.setContentType("text/plain;charset=UTF-8");
try (PrintWriter out = resp.getWriter()) {
out.println("User-Agent : " + req.getHeader("User-Agent"));
out.println("Accept : " + req.getHeader("Accept"));
out.println("Host : " + req.getHeader("Host"));
out.println("Lang : " + req.getHeader("Accept-Language"));
out.println("--- 全部请求头 ---");
Enumeration<String> names = req.getHeaderNames();
while (names.hasMoreElements()) {
String n = names.nextElement();
out.println(n + " = " + req.getHeader(n));
}
}
}
}getHeader 不区分大小写，getHeader("user-agent") 与 getHeader("User-Agent") 等价。同名头有多个值时用 getHeaders(name) 拿枚举。
读取 Cookie
Java
Cookie[] cookies = req.getCookies();
if (cookies != null) {
for (Cookie c : cookies) {
System.out.println(c.getName() + " = " + c.getValue());
}
}安全地取参数
Java
private static String param(HttpServletRequest req, String key, String dflt) {
String v = req.getParameter(key);
return (v == null || v.isBlank()) ? dflt : v.trim();
}
private static int intParam(HttpServletRequest req, String key, int dflt) {
try {
return Integer.parseInt(param(req, key, String.valueOf(dflt)));
} catch (NumberFormatException e) {
return dflt;
}
}getParameter 的返回值永远不要直接拼进 SQL 或 HTML。拼 SQL 就是注入，拼 HTML 就是 XSS。参数是不可信输入，必须走预编译语句和转义。