JS防注入,该怎么解决

    <script type="text/javascript" >
    function fang(str)
    {
      var inj_str="‘|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|;|or|-|+|,"; 
var sarray=new Array(); 
sarray=inj_str.split('|'); 
for (var i=0 ;i <inj_stra.length ;i++ )
{ 
if (str.indexOf(inj_stra)>=0) 
return true; 
} 
return false; 
}