过滤sql注入

//效验    
    protected static boolean sqlValidate(String str) {    
        str = str.toLowerCase();//统一转为小写    
        String badStr = "'|select|update|and|or|delete|insert|truncate|char|into|iframe|href|script|activex|html|flash"  
                + "|substr|declare|exec|master|drop|execute|"  
                + "union|;|--|+|,|like|%|#|*|<|>|$|@|\"|http|cr|lf|<|>|(|)";//过滤掉的sql关键字，可以手动添加       
        String[] badStrs = badStr.split("\\|");    
        for (int i = 0; i < badStrs.length; i++) {    
            if (str.indexOf(badStrs[i]) >= 0) {    
                return true;    
            }    
        }    
        return false;    
    }