SQL Server Database injected solution

Copy CodeThe code is as follows:
declare @delStr nvarchar (500)
Set @delStr = ' <script src=http://www.kansm.com/js/common.js></script> '--the field string injected here
/****************************************/

/********** The following are operational entities ************/
SET NOCOUNT ON

declare @tableName nvarchar (MB), @columnName nvarchar (m), @tbID int, @iRow int, @iResult int
declare @sql nvarchar (2000)

Set @iResult =0
DECLARE cur cursor FOR
Select Name,id from sysobjects where xtype= ' U '

Open cur
FETCH NEXT from cur into @tableName, @tbID

While @ @fetch_status =0
Begin
DECLARE CUR1 cursor FOR
Select name from syscolumns where Xtype in (231,167,239,175,) and id= @tbID
Open Cur1
FETCH NEXT from Cur1 into @columnName
While @ @fetch_status =0
Begin
Set @sql = ' Update [' + @tableName + '] set [' + @columnName + ']]= SUBSTRING ([' + @columnName + '], ' + ' 1, PATINDEX ('% ' + @d Elstr + '% ', [' + @columnName + '])-1 + ' + ' SUBSTRING ([' + @columnName + '], PATINDEX ('% ' + @delStr + '% ', [' + @col Umnname + '] + ' + ' len (' + @delStr + '), datalength ([' + @columnName + ']) where [' + @columnName + '] like '% ' + @delS tr+ '% '

EXEC sp_executesql @sql
Set @iRow =@ @rowcount
Set @iResult = @iResult + @iRow
If @iRow >0
Begin
print ' table: ' + @tableName + ', column: ' + @columnName + ' updated ' +convert (varchar), @iRow) + ' record; '
End
FETCH NEXT from Cur1 into @columnName


End
Close Cur1
Deallocate Cur1

FETCH NEXT from cur into @tableName, @tbID
End
print ' Database total ' +convert (varchar, @iResult) + ' record updated!!! '

Close cur
Deallocate cur
SET NOCOUNT OFF