jsp的防sql注入通用程序

public static boolean sql_inj(String str)
 {
    String inj_str = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+|,";
    String inj_stra[] = split(inj_str,"|");
    for (int i=0 ; i < inj_stra.length ; i++ )
    {
        if (str.indexOf(inj_stra[i])>=0)
        {
            return true;
        }
    }
    return false;
 }

 jsp中调用该函数检查是否包函非法字符
 <%
 if(request.getParameter("userID") != null)
    userID = request.getParameter("userID").trim();

  if (StringUtil.sql_inj(userID) || StringUtil.sql_inj(pwd)){
   %>
   <Script Language=javascript>alert('参数中包含非法字符！');history.back(-1);</Script>" ;
   <%
  }else{
  ……
 }%>