Multi-condition table Filtering

Attackers can bypass the database.

I didn't think about the question. It's easier to understand it. The answer is simple, but I have taken a detour.

There are two tables with the same structure: content as C, content_temp as T. The primary key is ID

Table t contains part of table C data. The condition that the title and answer are the same is used to determine whether the data exists in both tables. If so, the data in table t is deleted.

The first response builds a statement like this:

Delete from content_temp t where T. Title in (select title from content) and T. Answer in (select answer from content)

You can only find one in condition. Neither of the two in databases knows what to do.

Later, we did this and used a cursor loop to achieve the effect.

View code 1 declare @ title nvarchar (max );
2 declare @ answer nvarchar (max );
3
4 declare mycursor cursor
5 select title, answer from content;
6
7 Open mycursor;
8 fetch next from mycursor
9 into @ title, @ answer;
10
11 while @ fetch_status = 0
12 begin
13 print @ title;
14 Delete from content_temp
15 where title = @ title and answer = @ answer
16 fetch next from mycursor
17 into @ title, @ answer;
18
19 end
20
21 close mycursor;
22 deallocate mycursor

23 go

 

The result is that the execution speed is very slow, especially the large data volume. I have 0.3 million data records. I gave up the execution in five minutes. It is estimated that the execution will be completed in at least one hour, this is because there are too many loops.

The final solution is:

Delete from content_temp where ID in (select T. ID from content_temp tinner join content C on T. Title = C. Title and T. Answer = C. Answer)

Why can't we think of such a simple question after turning around? Attackers can bypass the database.

PS: When can I solve the bug not displayed in the blog garden code?