Practice: http://3b3.org/c.jsmalicious sqlinjection: Let SQL Injection go to hell

How can I delete objects as quickly as possible?
"<Script src = http://3b3.org/c.js> </script>"
---------------------------------------------------------------
Go to the SQL query Analyzer
Select your database
Step 1: First modify the SQL table owner to dbo
EXEC sp_MSforeachtable exec sp_changeobjectowner? , Dbo

Step 2: delete the js with the field being mounted in a unified manner
Declare @ delStr nvarchar (500)
Set @ delStr = <script src = http://3b3.org/c.js> </script>

Set nocount on

Declare @ tableName nvarchar (100), @ columnName nvarchar (100), @ tbID int, @ iRow int, @ iResult int
Declare @ SQL nvarchar (500)

Set @ iResult = 0
Declare cur cursor
Select name, id from sysobjects where xtype = U

Open cur
Fetch next from cur into @ tableName, @ tbID

While @ fetch_status = 0
Begin
Declare cur1 cursor
-- Xtype in (231,167,239,175, 35) is of the char, varchar, nchar, nvarchar, and text types.
Select name from syscolumns where xtype in (231,167,239,175, 35) and id = @ tbID
Open cur1
Fetch next from cur1 into @ columnName
While @ fetch_status = 0
Begin
Set @ SQL = update [+ @ tableName +] set [+ @ columnName +] = replace ([+ @ columnName +], + @ delStr + ,) where [+ @ columnName +] like % + @ delStr + %
Exec sp_executesql @ SQL
Set @ iRow = @ rowcount
Set @ iResult = @ iResult + @ iRow
If @ iRow> 0
Begin
Print table: + @ tableName +, column: + @ columnName + updated + convert (varchar (10), @ iRow) + record;
End
Fetch next from cur1 into @ columnName

End
Close cur1
Deallocate cur1

Fetch next from cur into @ tableName, @ tbID
End
Print database + convert (varchar (10), @ iResult) + records updated !!!

Close cur
Deallocate cur
Set nocount off
---------------------------------------------------------------
Completely eliminate SQL Injection

1. Do not use the sa user to connect to the database
2. Create a public permission database user and use the user to access the database
3. [role] Remove the select access permission of the public role to the sysobjects and syscolumns objects.
4. Right-click a [user] user name and choose "properties"> "Permissions"> "sysobjects" and "syscolumns"
5. Use the following code to check whether the permission is correct. If the permission is displayed, the permission is too high ):
DECLARE @ T varchar (255 ),
@ C varchar (255)
DECLARE Table_Cursor CURSOR
Select a. name, B. name from sysobjects a, syscolumns B
Where a. id = B. id and a. xtype = u and (B. xtype = 99 or B. xtype = 35 or B. xtype = 231 or B. xtype = 167)
OPEN Table_Cursor
Fetch next from Table_Cursor INTO @ T, @ C
WHILE (@ FETCH_STATUS = 0)
BEGIN print @ c
Fetch next from Table_Cursor INTO @ T, @ C
END
CLOSE Table_Cursor
DEALLOCATE Table_Cursor
---------------------------------------------------------------
How to inject 3b3.org c. js