A truly terrible way to prevent SQL injection

cheap.js

//validation for entering query
var notAllowed = ['select','SELECT','*','SeLeCt','sElEcT','{','}','(',')'];
for(var i = 0; i < notAllowed.length; i++){
  if(document.frmSurvey.txtComments.value.indexOf(notAllowed[i]) != -1){
    alert('The word "' + notAllowed[i] + '" is not allowed');
    document.frmSurvey.txtComments.value = document.frmSurvey.txtComments.value.substr(0, document.frmSurvey.txtComments.value.indexOf(notAllowed[i]));
    return false;
  }
}

'select','SELECT','*','SeLeCt','sElEcT' ?

So… use SELECt ! :)

More seriously, the javascript does not prevent requests server side, it will only prevent the user to put parentheses or write "select"
This script is useless, and you would could use "strtolower" ...