//效验        protected static boolean sqlValidate(String str) {            str = str.toLowerCase();//统一转为小写            String badStr = "'|select|update|and|or|delete|insert|truncate|char|into|iframe|href|script|activex|html|flash"                  + "|substr|declare|exec|master|drop|execute|"                  + "union|;|--|+|,|like|%|#|*|<|>|$|@|\"|http|cr|lf|<|>|(|)";//过滤掉的sql关键字，可以手动添加               String[] badStrs = badStr.split("\\|");            for (int i = 0; i < badStrs.length; i++) {                if (str.indexOf(badStrs[i]) >= 0) {                    return true;                }            }            return false;        }