jsp页面上提交登入表单防止非法字符sql注入js

function checkLogin(){  
                 var userName=document.getElementById("username").value;  
                 var userPass=document.getElementById("password").value;  
                 if(userName==''){  
                  alert("用户名不能为空！");  
                  return;  
                 }  
                   
                 if( filterSqlStr(userName)){  
                   alert("用户名字符中包含了敏感字符"+sql_str()+",请重新输入！");  
                   return ;  
                 }  
              
                 document.loginFrom.action="userLogin!login.action";  
                 document.loginFrom.submit();  
               }

function filterSqlStr(value){  
      
    var sqlStr=sql_str().split(',');  
    var flag=false;  
      
    for(var i=0;i<sqlStr.length;i++){  
          
        if(value.toLowerCase().indexOf(sqlStr[i])!=-1){  
            flag=true;  
            break;  
              
        }  
    }  
    return flag;  
}

function sql_str(){  
    var str="and,delete,or,exec,insert,select,union,update,count,*,',join,>,<";  
    return str;  
}