1. The first situation is the need to replace all the specified injection strings (replace only the injected string as empty)
Copy Code code as follows:
declare @delStr nvarchar (500)
Set @delStr = ' <script src=http://www.jb51.net/js/common.js></script> '--the field string injected here
/****************************************/
/********** The following are operational entities ************/
SET NOCOUNT ON
declare @tableName nvarchar (MB), @columnName nvarchar (m), @tbID int, @iRow int, @iResult int
declare @sql nvarchar (2000)
Set @iResult =0
DECLARE cur cursor FOR
Select Name,id from sysobjects where xtype= ' U '
Open cur
FETCH NEXT from cur into @tableName, @tbID
While @ @fetch_status =0
Begin
DECLARE CUR1 cursor FOR
Select name from syscolumns where Xtype in (231,167,239,175,) and id= @tbID
Open Cur1
FETCH NEXT from Cur1 into @columnName
While @ @fetch_status =0
Begin
Set @sql = ' Update [' + @tableName + '] set [' + @columnName + ']]= SUBSTRING ([' + @columnName + '], ' + ' 1, PATINDEX ('% ' + @d Elstr + '% ', [' + @columnName + '])-1 + ' + ' SUBSTRING ([' + @columnName + '], PATINDEX ('% ' + @delStr + '% ', [' + @col Umnname + '] + ' + ' len (' + @delStr + '), datalength ([' + @columnName + ']) where [' + @columnName + '] like '% ' + @delS tr+ '% '
EXEC sp_executesql @sql
Set @iRow =@ @rowcount
Set @iResult = @iResult + @iRow
If @iRow >0
Begin
print ' table: ' + @tableName + ', column: ' + @columnName + ' updated ' +convert (varchar), @iRow) + ' record; '
End
FETCH NEXT from Cur1 into @columnName
End
Close Cur1
Deallocate Cur1
FETCH NEXT from cur into @tableName, @tbID
End
print ' Database tutorial total ' +convert (varchar, @iResult) + ' record updated!!! '
Close cur
Deallocate cur
SET NOCOUNT OFF
2. The second is to delete the injection to the beginning of the table and the end of it. (This method directly finds the starting position of the injection and deletes all the following)
Copy Code code as follows:
--recovery is injected into the database
--2013-09-26
declare @delStr nvarchar (500)
Set @delStr = ' </title><style>. '--the start sample of the injected field string, and the data after this position is injected data
/********** The following are operational entities ************/
SET NOCOUNT ON
declare @tableName nvarchar (MB), @columnName nvarchar (m), @tbID int, @iRow int, @iResult int
declare @sql nvarchar (2000)
Set @iResult =0
DECLARE cur cursor FOR
Select Name,id from sysobjects where xtype= ' U '
Open cur
FETCH NEXT from cur into @tableName, @tbID
While @ @fetch_status =0
Begin
DECLARE CUR1 cursor FOR
Select name from syscolumns where Xtype in (231,167,239,175,) and id= @tbID
Open Cur1
FETCH NEXT from Cur1 into @columnName
While @ @fetch_status =0
Begin
Set @sql = ' Update [' + @tableName + '] set [' + @columnName + ']=
SUBSTRING ([' + @columnName + '],1, PATINDEX ('% ' + @delStr + '% ', [' + @columnName + '])-1 where [' + @columnName + '] Li Ke '% ' + @delStr + '% '
EXEC sp_executesql @sql
Set @iRow =@ @rowcount
Set @iResult = @iResult + @iRow
If @iRow >0
Begin
print ' table: ' + @tableName + ', column: ' + @columnName + ' updated ' +convert (varchar), @iRow) + ' record; '
End
FETCH NEXT from Cur1 into @columnName
End
Close Cur1
Deallocate Cur1
FETCH NEXT from cur into @tableName, @tbID
End
print ' Database tutorial total ' +convert (varchar, @iResult) + ' record updated!!! '
Close cur
Deallocate cur
SET NOCOUNT OFF
