JSP anti-SQL Injection Common Program

Public static Boolean SQL _inj (string Str)
{
String inj_str = "'| and | exec | insert | select | Delete | update | count | * | % | CHR | mid | master | truncate | char | declare |; | or |-| + | ,";
String inj_stra [] = Split (inj_str, "| ");
For (INT I = 0; I <inj_stra.length; I ++)
{
If (Str. indexof (inj_stra [I])> = 0)
{
Return true;
}
}
Return false;
}

JSP calls this function to check whether the letter contains invalid characters
<%
If (request. getparameter ("userid ")! = NULL)
Userid = request. getparameter ("userid"). Trim ();

If (stringutil. SQL _inj (userid) | stringutil. SQL _inj (PWD )){
%>
<Script language = JavaScript> alert ('parameter contains invalid characters! '); History. Back (-1); </SCRIPT> ";
<%
} Else {
......
} %>