Java safe String.format and escaping %
I'm using String.format
method of Java API to log something. My method is like:
public static void log(String message, Object... params){
System.out.println(String.format(message, params));
}
However the problem is, if the user sends a message that has %
character 开发者_Python百科somewhere in it, it throws exception. Here's a scenario:
log("SELECT * FROM my WHERE name like '%six%'");
and Java looks for something to replace %s
(that's ok) and %'
(oops). I want to fix that. Because there there are no params
and %s
will be lost and %'
causes exception.
One solution can be message.replace("%", "%%")
but I'm not sure it is an elegant solution or not.
log
has no idea whether a given %
is meant as a format specifier or as a percent sign. Consider the following example:
log("%s%s", "test");
Is that "test%s"
, "%stest"
, or an error?
Therefore, the problem will have to be addressed at the call site:
log(escape("SELECT * FROM my WHERE name like '%six%'"));
where escape()
is a function you'll need to write that'll replace all %
with %%
.
Alternatively, the following can be used at the call site:
log("%s", "SELECT * FROM my WHERE name like '%six%'");
A simple solution for the most likely misuse (using %s
or %
somewhere in the String
but providing no parameters) would be to provide a no-params overload to your method in addition to your original method:
public static void log(String message) {
System.out.println(message);
}
Alternatively you can dynamically try to detect the no-params case, but that's a bit more work:
public static void log(String message, Object... params) {
final String output;
if (params == null || params.length = 0) {
output = message;
} else {
output = String.format(message, params);
}
System.out.println(output);
}
One option would be to pass the string directly into the println if the length of params is 0. Another options would be to have two overloads.
public static void log(String message);
public static void log(String format, String param, String...params);
精彩评论