java SSH中防止非法登录 过滤器的使用

//实体类

public class UserBean {
 private int userid;
 private String username;
 private String password;

//get()和set()方法
}

//web.xml配置过滤器

<!-- 登录过滤器web配置
 <filter>
   <filter-name>loginFilter</filter-name>
   <filter-class>filter.LoginFilter</filter-class>
  
   <init-param>
    <param-name>login_uri</param-name>
    <param-value>/login.jsp</param-value>
   </init-param> 
   <init-param>
    <param-name>index_uri</param-name>
    <param-value>/index.jsp</param-value>
   </init-param>   
 </filter>
    <filter-mapping>
    <filter-name>loginFilter</filter-name>
    <url-pattern>/*</url-pattern>
    </filter-mapping>
    -->
    <!-- /*是指向任何页面都进行过滤 -->

//登录方法验证

import java.util.List;

import org.springframework.orm.hibernate3.support.HibernateDaoSupport;

public class UserManagerImplements extends HibernateDaoSupport implements
  UserManagerInterface {

 public boolean checkUser(String username, String password) {
  boolean flag = false;
  List list =getHibernateTemplate().find(
    "from UserBean where username=? and password=?",
    new String[]{username,password});
  if (list.size() != 0) {
   flag = true;
  }
  return flag;
 }

}

//登录过滤器编写
import user.UserManagerImplements;

import java.io.IOException;
import java.io.PrintWriter;

import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;

public class LoginFilter implements Filter {
 private static final String LOGIN_URI="login_uri";
 private static final String INDEX_URI="index_uri";
 private String login_page;
 private String index_page;
 public void init(FilterConfig filterConfig) throws ServletException {
  login_page=filterConfig.getInitParameter(LOGIN_URI);
  index_page=filterConfig.getInitParameter(INDEX_URI);
 
  if(null==login_page || null==index_page){
   throw new ServletException("没有指定的登录页面或主页");
  }
 }
 public void destroy() {
  // TODO Auto-generated method stub

 }
// private UserManagerInterface umi;
// public void setUmi(UserManagerInterface umi) {
//  this.umi = umi;
// }
 public void doFilter(ServletRequest request, ServletResponse response,
   FilterChain chain) throws IOException, ServletException {
 
  HttpServletRequest httpReq=(HttpServletRequest)request;
  HttpServletResponse httpResp=(HttpServletResponse)response;
  HttpSession session=httpReq.getSession();
  String request_uri=httpReq.getRequestURI();
  String ctxpath=httpReq.getContextPath();
  String uri=request_uri.substring(ctxpath.length());
  //判断用户访问的是否是登录页面
  if(login_page.equals(uri)){
   String strlogin=httpReq.getParameter("action");
   if("login".equals(strlogin)){
    //如果提交信息，则对用户进行验证
    String name=httpReq.getParameter("username").trim();
    String pwt=httpReq.getParameter("password").trim();
    if(new UserManagerImplements().checkUser(name,pwt)){
     session.setAttribute("islogin", "true");
     session.setAttribute("username", name);
     String origin_uri=httpReq.getParameter("origin_uri");
     if(null!=origin_uri && !"".equals(origin_uri)){
      httpResp.sendRedirect(origin_uri);
     }else{
      httpResp.sendRedirect(ctxpath+index_page);
      return;
     }
    }else{
     String origin_uri=httpReq.getParameter("origin_uri");
     if(null!=origin_uri && !"".equals(origin_uri)){
      httpReq.setAttribute("origin_uri", origin_uri);
     
     }
     httpResp.setContentType("text/html;charset=utf-8");
     PrintWriter out=httpResp.getWriter();
     out.print("<script language=javascript>alert('用户名或密码错误，请重新输入')</script>");
     RequestDispatcher rd=httpReq.getRequestDispatcher(login_page);
     rd.include(httpReq, httpResp);
     return;
    }
   }else{
    chain.doFilter(httpReq, httpResp);
    return;
   }
  }else{
   String islogin=(String)session.getAttribute("islogin");
   if("true".equals(islogin)){
    chain.doFilter(httpReq, httpResp);
    return;
   }else{
    String strQuery=httpReq.getQueryString();
    if(null!=strQuery){
     request_uri=request_uri+"?"+strQuery;
    }
    httpReq.setAttribute("origin_uri", request_uri);
    RequestDispatcher rd=httpReq.getRequestDispatcher(login_page);
    rd.forward(httpReq, httpResp);
    return;
   }
  }
 }

}