過濾sql注入

//效驗    
    protected static boolean sqlValidate(String str) {    
        str = str.toLowerCase();//統一轉為小寫    
        String badStr = "'|select|update|and|or|delete|insert|truncate|char|into|iframe|href|script|activex|html|flash"  
                + "|substr|declare|exec|master|drop|execute|"  
                + "union|;|--|+|,|like|%|#|*|<|>|$|@|\"|http|cr|lf|<|>|(|)";//過濾掉的sql關鍵字，可以手動添加       
        String[] badStrs = badStr.split("\\|");    
        for (int i = 0; i < badStrs.length; i++) {    
            if (str.indexOf(badStrs[i]) >= 0) {    
                return true;    
            }    
        }    
        return false;    
    }