24 01 2009

–该功能是删除所有包含@SearchString字符串位置开始,直到最末尾的数据
DECLARE @fieldtype sysname
DECLARE @SearchString varchar(500)
SET @fieldtype='nvarchar' –字段类型
SET @SearchString = '–需要删除的数据
–删除处理
DECLARE hCForEach CURSOR GLOBAL
FOR
Select N'update '+QUOTENAME(o.name)
+N' set '+ QUOTENAME(c.name) + N' = stuff(' + QUOTENAME(c.name) + ',charindex(''' + @SearchString + ''',' + QUOTENAME(c.name) + '),len(' + QUOTENAME(c.name) + '),'''')'
+N' where charindex(''' + @SearchString + ''',' + QUOTENAME(c.name) + ') > 0'
FROM sysobjects o,syscolumns c,systypes t
Where o.id=c.id
AND OBJECTPROPERTY(o.id,N'IsUserTable')=1
AND c.xusertype=t.xusertype
AND t.name=@fieldtype
EXEC sp_MSforeach_Worker @command1=N'?'
==============================
数据库被注入攻击 所有文本型字下段数据都被加了
怎么删掉？
SQL code
DECLARE @fieldtype sysname
SET @fieldtype='varchar'
–删除处理
DECLARE hCForEach CURSOR GLOBAL
FOR
Select N'update '+QUOTENAME(o.name)
+N' set '+ QUOTENAME(c.name) + N' = replace(' + QUOTENAME(c.name) + ','' '','''')'
FROM sysobjects o,syscolumns c,systypes t
Where o.id=c.id
AND OBJECTPROPERTY(o.id,N'IsUserTable')=1
AND c.xusertype=t.xusertype
AND t.name=@fieldtype
EXEC sp_MSforeach_Worker @command1=N'?'
========================================================
在sql查询分析器里可以执行以下的代码批量替换js代码：
update 表名 set 字段名=replace(字段名,'','')

注入攻击

辉克’s Blog 全新改版，欢迎大家游览! 永远，有多远？