SQL过滤防注入

public static String filParam(String param) {
  if (param== null) {
   param= "";
  }else {
   param= param.replaceAll("<", "&lt;").replaceAll(">", "&gt;");
   param= param.replaceAll("\\(", "&#40;").replaceAll("\\)", "&#41;");
   param= param.replaceAll("'", "");
   param= param.replaceAll("eval\\((.*)\\)", "");
   param= param.replaceAll("[\\\" \\'][\\s]*javascript:(.*)[\\\"\\']", "\"\"");
   param= param.replaceAll("script", "");
   param= StringUtil.patternString(param,"insert( \\s+)");
   param= StringUtil.patternString(param,"delete( \\s+)");
   param= StringUtil.patternString(param,"update( \\s+)");
   param= StringUtil.patternString(param,"select( \\s+)");
   param= StringUtil.patternString(param,"create( \\s+)");
   param= StringUtil.patternString(param,"alter( \\s+)");
   param= StringUtil.patternString(param,"drop( \\s+)");
  }
  return param;
 }