title: Using (.matches) boolean statement prevents XSS attack?
body: <p>I am using the below mentioned boolean statement to know if the string i got from the input box contains any special character.  I want to know is it a good way to prevent XSS attack and can this filter be bypassed ?</p>
  
  <pre><code>!id.matches(".*[%#^&lt;&gt;&amp;;'\0-].*")
  </code></pre>
  
  <p>Here's the complete code</p>
  
  <pre><code>package pack.java;
  
  import pack.java.findrequestmodel;
  import java.io.*;
  import java.lang.*;
  import org.apache.commons.lang.StringEscapeUtils;
  import java.sql.*;
  import javax.servlet.*;
  import javax.servlet.http.*;
  import javax.servlet.jsp.*;
  import javax.servlet.jsp.tagext.*;
  
  public class findrequestcontrol extends TagSupport
  {
      HttpServletRequest request;
      HttpServletResponse response;
  
      public int doStartTag() throws JspException
      {
          request = (HttpServletRequest) pageContext.getRequest();
          response = (HttpServletResponse) pageContext.getResponse();
  
          return EVAL_PAGE;
      }
  
      public ResultSet check()
      {
          JspWriter out = pageContext.getOut();
          Connection con;
          ResultSet rs = null;
          CallableStatement stmt;
          String checkreq = "";
          String reqnum = (String) findrequestmodel.requestno.trim();
  
          try
          {
              Class.forName("oracle.jdbc.driver.OracleDriver");
          }
          catch (ClassNotFoundException ex)
          {
          }
          try
          {
              if (!reqnum.matches(".*[%#^&lt;&gt;&amp;;'\0-].*") )
              {
                  con = DriverManager.getConnection("jdbc:oracle:thin:@localhost:1521:XE","gaurav","oracle");
                  stmt=con.prepareCall("begin requestdetail(?); end;");
                  stmt.setString(1,reqnum);          
                  rs=stmt.executeQuery();
              }
              else
                  out.println("Invalid Number");
          }
          catch(SQLException ex)
          {
          }
          catch(Exception ex)
          {
          }
  
          return rs;
      }
  
      public int doEndTag() throws JspException
      {   
          JspWriter out=pageContext.getOut();
          ResultSet rs=check();
  
          try
          {      
              if (!rs.next()) 
              {  
                  out.println("no data found");  
              }  
              else
              {   
                  out.println("&lt;table border=2&gt;");
                  out.println("&lt;tr&gt;");
                  out.println("&lt;th&gt;EmployeId&lt;/th&gt;");
                  out.println("&lt;/tr&gt;");
  
                  do 
                  {
                      out.println("&lt;tr&gt;");
                      out.println("&lt;td&gt;"+rs.getString(1)+"&lt;/td&gt;");
                      out.println("&lt;/tr&gt;");
                  } while (rs.next());
              }
  
          }
          catch(Exception ex)
          {
          }
  
          return super.doEndTag();
      }
  }
  </code></pre>
  
  <p>Below is the jsp page, the string is entered here and on submit redirects to a different page where tag is called.</p>
  
  <pre><code>&lt;html&gt;
      &lt;head&gt;
      &lt;/head&gt;
      &lt;body&gt;
          &lt;form method=post&gt;
              &lt;input type=text style="color:grey" name=reqno &lt;/br&gt;
              &lt;input type = submit name = submit value = Submit&gt;
  
              &lt;%
                  String r=request.getParameter("reqno");
                  String btn=request.getParameter("submit");
  
                  HttpSession session1=request.getSession();
                  session1.setAttribute("requestno",r);
  
                  if (btn != null)
                      response.sendRedirect("findrequest1.jsp");
              %&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>Here the tag is invoked</p>
  
  <pre><code>&lt;jsp:useBean id="MrBean" class="pack.java.findrequestmodel"/&gt;
  &lt;jsp:setProperty name="MrBean" property="requestno" value=""/&gt;
  &lt;%@ taglib uri="/WEB-INF/jsp2/taglib8.tld" prefix="easy" %&gt;
  &lt;html&gt;
      &lt;head&gt;
      &lt;body&gt;
          &lt;form method=post&gt;
              &lt;input type = submit name = submit value = Back&gt;
              &lt;%
                  HttpSession mysession = request.getSession();
                  String req = (String) mysession.getAttribute("requestno");
  
                  MrBean.setRequestno(req);
  
                  String btn = request.getParameter("submit");
  
                  if (btn != null)
                      response.sendRedirect("findrequest.jsp");
              %&gt;
              &lt;easy:myTag8/&gt;
          &lt;/form&gt;
      &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>