确保Web表单数据完整性：后端验证的必要性与实践

<form action="userreg" method="post">
    Username : <input type="text" name="username" pattern=".{3,}" title ="must contains more then 3 letters" required><br/><br/>
    Password : <input type="password" name="password" placeholder="password must be 8 char long one upper, lower case letter must" pattern="(?=.*d)(?=.*[a-z])(?=.*[A-Z]).{8,}" title="Must have 8 chars one lowercase , uppercase" required><br/><br/>
    FirstName: <input type="text" pattern=".{3,}" title="this field cant be empty" name="firstname" required><br/><br/>
    Last Name: <input type="text" pattern=".{3,}" title="this field cant be empty" name="lastname" required><br/><br/>
    Address : <input type="text"  pattern=".{3,}" name="address" required><br/><br/>
    Phone No : <input type="text" pattern=".{3,}" name="phone" required><br/><br/>
    Email Id : <input type="text" pattern="[a-z0-9._%+-]+@[a-z0-9.-]+.[a-z]{2,}$" name="mailid" placeholder="email@example.com" title="please enter valid mail" required><br/><br/>
    <input type="submit" value=" I AGREE FOR ALL TERMS & CONDITIONS ! REGISTER ME ">
</form>

import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.PreparedStatement;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class UserRegistrationServlet extends HttpServlet {

    protected void doPost(HttpServletRequest req, HttpServletResponse res) 
            throws ServletException, IOException {
        res.setContentType("text/html");
        PrintWriter pw = res.getWriter();

        String uName = req.getParameter("username");
        String pWord = req.getParameter("password");
        String fName = req.getParameter("firstname");
        String lName = req.getParameter("lastname");
        String addr = req.getParameter("address");
        String phNo = req.getParameter("phone");
        String mailId = req.getParameter("mailid");

        // 1. 后端数据验证
        if (uName == null || uName.trim().isEmpty() || uName.trim().length() < 3) {
            sendErrorResponse(req, res, pw, "用户名不能为空且至少3个字符！");
            return;
        }
        if (pWord == null || pWord.trim().isEmpty() || !pWord.matches("(?=.*\d)(?=.*[a-z])(?=.*[A-Z]).{8,}")) {
            sendErrorResponse(req, res, pw, "密码不符合要求（至少8位，包含大小写字母和数字）！");
            return;
        }
        if (fName == null || fName.trim().isEmpty() || fName.trim().length() < 3) {
            sendErrorResponse(req, res, pw, "姓氏不能为空且至少3个字符！");
            return;
        }
        // ... 对其他字段进行类似验证 ...
        if (mailId == null || mailId.trim().isEmpty() || !mailId.matches("[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$")) {
            sendErrorResponse(req, res, pw, "邮箱格式不正确！");
            return;
        }

        try {
            Connection con = DBConnection.getCon(); // 假设DBConnection是一个数据库连接工具类
            // 2. 检查用户名是否已存在（业务逻辑验证）
            if (isUsernameTaken(con, uName)) {
                sendErrorResponse(req, res, pw, "用户名已被占用，请选择其他用户名！");
                return;
            }

            PreparedStatement ps = con
                    .prepareStatement("insert into " + IUserContants.TABLE_USERS + "  values(?,?,?,?,?,?,?,?)");
            ps.setString(1, uName.trim()); // 插入前再次trim，确保数据干净
            ps.setString(2, pWord.trim());
            ps.setString(3, fName.trim());
            ps.setString(4, lName != null ? lName.trim() : ""); // 处理可能为空的字段
            ps.setString(5, addr != null ? addr.trim() : "");
            ps.setString(6, phNo != null ? phNo.trim() : "");
            ps.setString(7, mailId.trim());
            ps.setInt(8, 2); // 假设这是用户角色ID

            int k = ps.executeUpdate();         
            if (k == 1) {
                RequestDispatcher rd = req.getRequestDispatcher("Sample.html");
                rd.include(req, res);
                pw.println("<h3 class='tab'>用户注册成功！</h3>");
            } else {
                sendErrorResponse(req, res, pw, "注册失败，请检查您的输入！");
            }
        } catch (Exception e) {
            e.printStackTrace();
            sendErrorResponse(req, res, pw, "服务器内部错误，请稍后再试！");
        } finally {
            // 关闭数据库连接等资源
            // DBConnection.closeCon(con); 假设有这样的方法
        }
    }

    private void sendErrorResponse(HttpServletRequest req, HttpServletResponse res, PrintWriter pw, String message) 
            throws ServletException, IOException {
        RequestDispatcher rd = req.getRequestDispatcher("Sample.html"); // 返回到注册页面或显示错误页面
        rd.include(req, res); // 包含原始页面内容
        pw.println("<h3 class='tab' style='color:red;'>" + message + "</h3>");
    }

    // 示例：检查用户名是否已存在
    private boolean isUsernameTaken(Connection con, String username) throws Exception {
        PreparedStatement ps = null;
        java.sql.ResultSet rs = null;
        try {
            ps = con.prepareStatement("SELECT COUNT(*) FROM " + IUserContants.TABLE_USERS + " WHERE username = ?");
            ps.setString(1, username.trim());
            rs = ps.executeQuery();
            if (rs.next()) {
                return rs.getInt(1) > 0;
            }
            return false;
        } finally {
            if (rs != null) rs.close();
            if (ps != null) ps.close();
        }
    }
}