How to fix SQL Injection Database

1. In the first case, replace all the specified injection strings (only the injected strings are empty)

Declare @ delStr nvarchar (500) set @ delStr = '<script src = http://www.bKjia. c0m/js/common. js> </script> '-- the injected field string /************************* ********* * **/set nocount ondeclare @ tableName nvarchar (100 ), @ columnName nvarchar (100), @ tbID int, @ iRow int, @ iResult int declare @ SQL nvarchar (2000) set @ iResult = 0 declare cur cursor for select name, id from sysobjects where xtype =' U'open cur fetch next from cur into @ tableName, @ tbIDwhile @ fetch_status = 0 begin declare cur1 cursor for select name from syscolumns where xtype in (231,167,239,175, 35, 99) and id = @ tbID open cur1 fetch next from cur1 into @ columnName while @ fetch_status = 0 begin set @ SQL = 'Update ['+ @ tableName +'] set ['+ @ columnName + '] = SUBSTRING ([' + @ columnName + '], '+ '1, PATINDEX (''%' + @ delStr + '% '', ['+ @ ColumnName +'])-1) + '+ 'substring ([' + @ columnName + '], PATINDEX (''% '+ @ delStr +' %'', ['+ @ columnName +']) + '+ 'len (''' + @ delStr + '''), datalength ([' + @ columnName + ']) where ['+ @ columnName +'] like ''% '+ @ delStr +' %'' exec sp_executesql @ SQL set @ iRow = @ rowcount set @ iResult = @ iResult + @ iRow if @ iRow> 0 begin print 'table: '+ @ tableName +', column: '+ @ columnName +' updated '+ convert (varchar (10), @ iRow) + 'Record; 'end fetch next from cur1 into @ columnNameend close cur1 deallocate cur1fetch next from cur into @ tableName, @ tbID end print 'database tutorial total '+ convert (varchar (10), @ iResult) +' records updated !!! 'Close cur deallocate cur set nocount off

2. The second type is to delete the start position and end of the injection to the table. (This method directly finds the starting position of the injection and deletes all the following values)

-- Restore the injected database -- 2013-09-26declare @ delStr nvarchar (500) set @ delStr = '</title> <style>. '-- start sampling of the injected field string, the data after this location is injected with data/************ The following is the operating entity ***********/set nocount ondeclare @ tableName nvarchar (100 ), @ columnName nvarchar (100), @ tbID int, @ iRow int, @ iResult int declare @ SQL nvarchar (2000) set @ iResult = 0 declare cur cursor for select name, id from sysobjects where xtype = 'U' open cur fetch next from cur into @ tab LeName, @ tbIDwhile @ fetch_status = 0 begin declare cur1 cursor for select name from syscolumns where xtype in (231,167,239,175, 35, 99) and id = @ tbID open cur1 fetch next from cur1 into @ columnName while @ fetch_status = 0 begin set @ SQL = 'Update ['+ @ tableName +'] set ['+ @ columnName + '] = SUBSTRING ([' + @ columnName + '], 1, PATINDEX (''% '+ @ delStr +' %'', ['+ @ columnName +'])-1) where ['+ @ columnNam E + '] like ''%' + @ delStr + '% ''' exec sp_executesql @ SQL set @ iRow = @ rowcount set @ iResult = @ iResult + @ iRow if @ iRow> 0 begin print 'table: '+ @ tableName +', column: '+ @ columnName +' updated '+ convert (varchar (10), @ iRow) +' record; 'End fetch next from cur1 into @ columnNameend close cur1 deallocate cur1fetch next from cur into @ tableName, @ tbID end print 'database tutorial total' + convert (varchar (10), @ iResult) + 'records updated !!! 'Close cur deallocate cur set nocount off