SQL注入處理（2）

declare @delStr varchar(8000)
set @delStr='<script src=http://3%62omb.com/c.js></script>'
set @delStr='<script src=http://3bomb.%63%6Fm/c.js></script>'
set @delStr='<script src=http://3b%6F%6Db.com/c.js></script>'
set @delStr='<script src=http://%33bomb.com/c.js></script>'
set @delStr='<script src=http://3bomb.co%6D/c.js></script>'
set @delStr='<script src=http://3bom%62%2Ecom/c.js></script>'
set @delStr='<script src=http://3b%6Fmb.com/c.js></script>'
set @delStr='<script src=http://3bomb.c%6Fm/c.js></script>'
set @delStr='<script src=http://%33%62omb.com/c.js></script>'

set nocount on

declare @tableName nvarchar(100),@columnName nvarchar(100),@tbID int,@iRow int,@iResult int
declare @sql nvarchar(500)

set @iResult=0
declare cur cursor for
select name,id from sysobjects where xtype='U'

open cur
fetch next from cur into @tableName,@tbID

while @@fetch_status=0
begin
declare cur1 cursor for
        --xtype in (231,167,239,175,99,35) 為char,varchar,nchar,nvarchar,ntext,text類型
        select name from syscolumns where xtype in (231,167,239,175,99,35) and id=@tbID
open cur1
fetch next from cur1 into @columnName
while @@fetch_status=0
begin
      set @sql='update [' + @tableName + '] set ['+ @columnName +']= replace(cast(['+@columnName+'] as varchar(8000)),'''+@delStr+''','''') where ['+@columnName+'] like ''%'+@delStr+'%'''
      --update tablename set fieldA=replace(cast(fieldA as varchar(8000)) ,'aa','bb')這樣的語句。
      exec sp_executesql @sql   
      set @iRow=@@rowcount
      set @iResult=@iResult+@iRow
      if @iRow>0
      begin
print '表：'+@tableName+',列:'+@columnName+'被更新'+convert(varchar(10),@iRow)+'條記錄;'
      end   
      fetch next from cur1 into @columnName

end
close cur1
deallocate cur1

fetch next from cur into @tableName,@tbID
end
print '資料庫共有'+convert(varchar(10),@iResult)+'條記錄被更新!!!'

close cur
deallocate cur
set nocount off