1  var Sstr = ["and","or","exec","execute","insert","select","delete","update","alter","create",

"drop","count","chr","char","asc","mid","substring","master","truncate","declare","xp_cmdshell","restore","backup",

"net +user","onblur","convert","onmouseover","ping","response","sysdatabases","net","localgroup
 
",

"administrators","@","#","&","%","/","{","\""];
 2                 var inputStr = "";
 3                 if ($.trim($('#textareanote').val()) != "") {
 4                     inputStr = $('#textareanote').val();
 5                     for (var x = 0; x < Sstr.length; x++) {
 6                         if
 
 (inputStr.match(Sstr[x])) {
 7                             alert("\""+Sstr[x]+"\"字元不符合輸入規則，請檢查輸入內容！")
 8                             return false
 9                         }
10                     }
11                     
12                 }

輸入的字串是在前臺呼叫ajax進行處理的，所以要在js中判斷是否有攻擊字串。

一開始Sstr是定義的字串，後來發現字串不知道用什麼符號隔開，就改成了陣列，用for迴圈。

注意：括號不能加在這個數組裡，會報錯。對括號進行轉義也沒有用，後來想想，括號沒什麼影響，就沒有過濾。

感謝我200多斤的同事鼎力相助，我是真不會寫js。。