1  var Sstr = ["and","or","exec","execute","insert","select","delete","update","alter","create",

"drop","count","chr","char","asc","mid","substring","master","truncate","declare","xp_cmdshell","restore","backup",

"net +user","onblur","convert","onmouseover","ping","response","sysdatabases","net","localgroup",

"administrators","@","#","&","%","/","{","\""];
 2                 var inputStr = "";
 3                 if ($.trim($('#textareanote').val()) != "") {
 4                     inputStr = $('#textareanote').val();
 5                     for (var x = 0; x < Sstr.length; x++) {
 6                         if (inputStr.match(Sstr[x])) {
 7                             alert("\""+Sstr[x]+"\"字符不符合输入规则，请检查输入内容！")
 8                             return false
 9                         }
10                     }
11                     
12                 }

输入的字符串是在前台调用ajax进行处理的，所以要在js中判断是否有攻击字符串。

一开始Sstr是定义的字符串，后来发现字符串不知道用什么符号隔开，就改成了数组，用for循环。

注意：括号不能加在这个数组里，会报错。对括号进行转义也没有用，后来想想，括号没什么影响，就没有过滤。

感谢我200多斤的同事鼎力相助，我是真不会写js。。