Clear SQL statements injected with script malicious virus code

Run the following code in the SQL query analyzer.

1. Declare @ t varchar (255), @ c varchar (255)
2. Declare table_cursor cursor for select a. name, B. name
3. From sysobjects a, syscolumns B, policypes c
4. Where a. id = B. id and a. xtype = 'U' and c. name
5. In ('Char ', 'nchar', 'nvarchar ', 'varchar', 'text', 'ntext ')
6. Declare @ str varchar (500), @ str2 varchar (500)
7. Set @ str = '<script src = http://r01.3322.org/c.js> </script>'/* content to be replaced */
8. Set @ str2 =''
9. Open table_cursor
10. Fetch next from table_cursor
11. Into @ t, @ c while (@ fetch_status = 0)
12. Begin exec ('Update ['+ @ t +'] set ['+ @ c +'] = replace (cast (['+ @ c +'] as varchar (8000) ), ''' + @ str + ''', ''' + @ str2 + ''')')
13. Fetch next from table_cursor
14. Into @ t, @ c end close table_cursor deallocate table_cursor;

First Replace the <script src = http://r01.3322.org/c.js> </script> in the code, that is, the red part is the content injected into your database table, open the SQL query Analyzer of MSSQL and execute the following code.