javascript不让其输入特殊字符

<input type="text" data-bind="value:EXPERTNAME" onblur="CheckQueryStr(this);" class="z-txt" />

function CheckQueryStr(oField) {
re = /select|update|delete|exec|count|'|、|‘|"|“|”|=|;|>|<|%/i;
$sMsg = "请不要输入非法字符！"
if (re.test(oField.value)) {
alert($sMsg);
oField.value = '';
oField.focus();
return false;
}
}