SQL语句征集

luhongjun 2001-07-21 08:03:26
加精
在我们进行数据库程序设计的时候经常用到SQL语句,但一直没有找到关于这些语句完整的介绍,现征集经常用到的SQL语句(最好加简单的说明及例子).
1:查询语句(select)(嵌套查询)
2:数据更新语句(delete,update,insert)
3:修改结构(alter)(应该包括增加字段,删除字段,修改字段长度,修改字段类型等)
4:创建表(create)
5:删除表
6:创建视图(create view)
7:创建游标(create cursor)
8:创建索引(create index)
给分标准:
1:20
2:20
3:100
4:10
5:100
6:10
7:20
8:20
...全文
95 7 打赏 收藏 转发到动态 举报
写回复
用AI写文章
7 条回复
切换为时间正序
请发表友善的回复…
发表回复
luhongjun 2001-07-21
  • 打赏
  • 举报
回复
OK给分
guo 2001-07-21
  • 打赏
  • 举报
回复
OK,
3.ALTER TABLE table
{ [ALTER COLUMN column_name
{ new_data_type [ (precision[, scale] ) ]
[ NULL | NOT NULL ]
| {ADD | DROP} ROWGUIDCOL
}
]
| ADD
{ [ <column_definition> ]
| column_name AS computed_column_expression
}[,...n]
| [WITH CHECK | WITH NOCHECK] ADD
{ <table_constraint> }[,...n]
| DROP
{ [CONSTRAINT] constraint_name
| COLUMN column
}[,...n]
| {CHECK | NOCHECK} CONSTRAINT
{ALL | constraint_name[,...n]}
| {ENABLE | DISABLE} TRIGGER
{ALL | trigger_name[,...n]}
}

<column_definition> ::= { column_name data_type }
[ [ DEFAULT constant_expression ]
| [ IDENTITY [(seed, increment ) [NOT FOR REPLICATION] ] ]
]
[ ROWGUIDCOL ]
[ <column_constraint>] [ ...n]

<column_constraint> ::= [CONSTRAINT constraint_name]
{
[ NULL | NOT NULL ]
| [ { PRIMARY KEY | UNIQUE }
[CLUSTERED | NONCLUSTERED]
[WITH FILLFACTOR = fillfactor]
[ON {filegroup | DEFAULT} ]]
]
| [ [FOREIGN KEY]
REFERENCES ref_table [(ref_column) ]
[NOT FOR REPLICATION]
]
| CHECK [NOT FOR REPLICATION]
(logical_expression)
}


<table_constraint> ::= [CONSTRAINT constraint_name]
{ [ { PRIMARY KEY | UNIQUE }
[ CLUSTERED | NONCLUSTERED]
{ ( column[,...n] ) }
[ WITH FILLFACTOR = fillfactor]
[ON {filegroup | DEFAULT} ]
]
| FOREIGN KEY
[(column[,...n])]
REFERENCES ref_table [(ref_column[,...n])]
[NOT FOR REPLICATION]
| DEFAULT constant_expression
[FOR column]
| CHECK [NOT FOR REPLICATION]
(logical_expression)
}
------------------------------------
4.CREATE TABLE
[
database_name.[owner].
| owner.
] table_name
(
{ <column_definition>
| column_name AS computed_column_expression
| <table_constraint>
} [,...n]
)
[ON {filegroup | DEFAULT} ]
[TEXTIMAGE_ON {filegroup | DEFAULT} ]




<column_definition> ::= { column_name data_type }
[ [ DEFAULT constant_expression ]
| [ IDENTITY [(seed, increment ) [NOT FOR REPLICATION] ] ]
]
[ ROWGUIDCOL ]
[ <column_constraint>] [ ...n]




<column_constraint> ::= [CONSTRAINT constraint_name]
{
[ NULL | NOT NULL ]
| [ { PRIMARY KEY | UNIQUE }
[CLUSTERED | NONCLUSTERED]
[WITH FILLFACTOR = fillfactor]
[ON {filegroup | DEFAULT} ]]
]
| [ [FOREIGN KEY]
REFERENCES ref_table [(ref_column) ]
[NOT FOR REPLICATION]
]
| CHECK [NOT FOR REPLICATION]
(logical_expression)
}




<table_constraint> ::= [CONSTRAINT constraint_name]
{
[ { PRIMARY KEY | UNIQUE }
[ CLUSTERED | NONCLUSTERED]
{ ( column[,...n] ) }
[ WITH FILLFACTOR = fillfactor]
[ON {filegroup | DEFAULT} ]
]
| FOREIGN KEY
[(column[,...n])]
REFERENCES ref_table [(ref_column[,...n])]
[NOT FOR REPLICATION]
| CHECK [NOT FOR REPLICATION]
(search_conditions)
}

------------------------------------
5.DROP TABLE (T-SQL)
Removes a table definition and all data, indexes, triggers, constraints, and permission specifications for that table. Any view or stored procedure that references the dropped table must be explicitly dropped by using the DROP VIEW or DROP PROCEDURE statement.

Syntax
DROP TABLE table_name

Arguments
table_name
Is the name of the table to be removed.
------------------------------------------
6.CREATE VIEW view_name [(column [,...n])]
[WITH ENCRYPTION]
AS
select_statement
[WITH CHECK OPTION]

Arguments
view_name
Is the name of the view. View names must follow the rules for identifiers. Specifying the view owner name is optional.
column
Is the name to be used for a column in a view. Naming a column in CREATE VIEW is necessary only when a column is derived from an arithmetic expression, a function, or a constant, when two or more columns may otherwise have the same name (usually because of a join), or when a column in a view is given a name different from that of the column from which it is derived. Column names can also be assigned in the SELECT statement.
If column is not specified, the view columns acquire the same names as the columns in the SELECT statement.


--------------------------------------------------------------------------------

Note In the columns for the view, the permissions for a column name apply across a CREATE VIEW or ALTER VIEW statement, regardless of the source of the underlying data. For example, if permissions are granted on the title_id column in a CREATE VIEW statement, an ALTER VIEW statement can name the title_id column with a different column name, such as qty, and still have the permissions associated with the view using title_id.


--------------------------------------------------------------------------------

n
Is a placeholder indicating that multiple columns can be specified.
WITH ENCRYPTION
Encrypts the syscomments entries that contain the text of the CREATE VIEW statement.
AS
Are the actions the view is to take.
select_statement
Is the SELECT statement that defines the view. It can use more than one table and other views. To select from the objects referenced in the SELECT clause of a view being created, it is necessary to have the appropriate permissions.
A view does not have to be a simple subset of the rows and columns of one particular table. A view can be created using more than one table or other views with a SELECT clause of any complexity.

There are, however, a few restrictions on the SELECT clauses in a view definition. A CREATE VIEW statement cannot:

Include ORDER BY, COMPUTE, or COMPUTE BY clauses.
Include the INTO keyword.
Reference a temporary table.
Because select_statement uses the SELECT statement, it is valid to use <join_hint> and <table_hint> hints as specified in the FROM clause. For more information, see FROM and SELECT.

Functions can be used in the select_statement.

select_statement can use multiple SELECT statements separated by UNION to create a query using partitioned data.

For partitioned data to be used in ALTER VIEW or CREATE VIEW, constraint values must be able to be verified. If constraint checking has been disabled, reenable constraint checking with either the WITH CHECK option or the CHECK constraint_name options of ALTER TABLE. It is not necessary to have constraints to use partitioned data; however, query optimization generates less optimal plans without constraints. For more information, see Scenarios for Using Views.

WITH CHECK OPTION
Forces all data modification statements executed against the view to adhere to the criteria set within select_statement. When a row is modified through a view, the WITH CHECK OPTION guarantees that the data remains visible through the view after the modification has been committed.
------------------------------------------------------
7.sql中没有这句话
------------------------------------------------------
8.CREATE [UNIQUE] [CLUSTERED | NONCLUSTERED]
INDEX index_name ON table (column [,...n])
[WITH
[PAD_INDEX]
[[,] FILLFACTOR = fillfactor]
[[,] IGNORE_DUP_KEY]
[[,] DROP_EXISTING]
[[,] STATISTICS_NORECOMPUTE]
]
[ON filegroup]

luhongjun 2001-07-21
  • 打赏
  • 举报
回复
guo(正在消化Oracle)谢谢.
你答了:1:查询语句(select)(嵌套查询)
2:数据更新语句(delete,update,insert)
外加一个连接表(join)
其他的有么,把帮助给我粘过来,我急用,手头上没有ms sql server,我现在机器上只有ACCESS
我看了,《SQL Server 2000 Books Online》 有30多M,我下不了,我的MODEN 33.6的.

DTWUJP 2001-07-21
  • 打赏
  • 举报
回复
你要是E文菜,可以看一下SQLSERVER2000中文版的联机帮助,很详细,买一张D版的吧。
guo 2001-07-21
  • 打赏
  • 举报
回复
我不为分,为朋友,看着
1.joined_table>
Is a result set that is the product of two or more tables, for example:
FROM tab1 LEFT OUTER JOIN tab1.c3 = tab2.c3
RIGHT OUTER JOIN tab3 LEFT OUTER JOIN tab4
ON tab3.c1
ON tab2.c3 = tab4.c3


For multiple CROSS joins, use parentheses to change the natural order of the joins.

<join_type>
Specifies the type of join operation.
INNER
Specifies that all matching pairs of rows are returned. Discards unmatched rows from both tables. This is the default if no join type is specified.
LEFT [OUTER]
Specifies that all rows from the left table not meeting the specified condition are included in the result set in addition to all rows returned by the inner join. Output columns from the left table are set to NULL.
RIGHT [OUTER]
Specifies that all rows from the right table not meeting the specified condition are included in the result set in addition to all rows returned by the inner join. Output columns from the right table are set to NULL.
FULL [OUTER]
If a row from either the left or right table does not match the selection criteria, specifies the row be included in the result set, and output columns that correspond to the other table be set to NULL. This is in addition to all rows usually returned by the inner join.
<join_hint>
Specifies a join hint or execution algorithm. If <join_hint> is specified, INNER, LEFT, RIGHT, or FULL must also be explicitly specified. For more information about join hints, see FROM.
JOIN
Indicates that the specified tables or views should be joined.
ON <search_condition>
Specifies the condition on which the join is based. The condition can specify any predicate, although columns and comparison operators are often used, for example:
SELECT ProductID, Suppliers.SupplierID
FROM Suppliers JOIN Products
ON (Suppliers.SupplierID = Products.SupplierID)


When the condition specifies columns, the columns do not have to have the same name or same data type; however, if the data types are not identical, they must be either compatible or types that Microsoft® SQL Server™ can implicitly convert. If the data types cannot be implicitly converted, the condition must explicitly convert the data type using the CAST function.

For more information about search conditions and predicates, see Search Condition.

CROSS JOIN
Specifies the cross-product of two tables. Returns the same rows as if the tables to be joined were simply listed in the FROM clause and no WHERE clause was specified. For example, both of these queries return a result set that is a cross join of all the rows in T1 and T2:
SELECT * FROM T1, T2

SELECT * FROM T1 CROSS JOIN T2
=================================================

2.DELETE (T-SQL)
Removes rows from a table.

Syntax
DELETE
[FROM ]
{
table_name WITH ( <table_hint_limited> [...n])
| view_name
| rowset_function_limited
}

[ FROM {<table_source>} [,...n] ]

[WHERE
{ <search_condition>
| { [ CURRENT OF
{
{ [ GLOBAL ] cursor_name }
| cursor_variable_name
}
]
}
]
[OPTION (<query_hint> [,...n])]


<table_source> ::=
table_name [ [AS] table_alias ] [ WITH ( <table_hint> [,...n]) ]
| view_name [ [AS] table_alias ]
| rowset_function [ [AS] table_alias ]
| derived_table [AS] table_alias [ (column_alias [,...n] ) ]
| <joined_table>


<joined_table> ::=
<table_source> <join_type> <table_source> ON <search_condition>
| <table_source> CROSS JOIN <table_source>
| <joined_table>


<join_type> ::=
[ INNER | { { LEFT | RIGHT | FULL } [OUTER] } ]
[ <join_hint> ]
JOIN


<table_hint_limited> ::=
{ INDEX(index_val [,...n])
| FASTFIRSTROW
| HOLDLOCK
| PAGLOCK
| READCOMMITTED
| REPEATABLEREAD
| ROWLOCK
| SERIALIZABLE
| TABLOCK
| TABLOCKX
}


<table_hint> ::=
{ INDEX(index_val [,...n])
| FASTFIRSTROW
| HOLDLOCK
| NOLOCK
| PAGLOCK
| READCOMMITTED
| READPAST
| READUNCOMMITTED
| REPEATABLEREAD
| ROWLOCK
| SERIALIZABLE
| TABLOCK
| TABLOCKX
| UPDLOCK
}


<query_hint> ::=
{ { HASH | ORDER } GROUP
| { CONCAT | HASH | MERGE } UNION
| FAST number_rows
| FORCE ORDER
| MAXDOP
| ROBUST PLAN
| KEEP PLAN
INSERT [INTO]
{
table_name WITH ( <table_hint_limited> [...n])
| view_name
| rowset_function_limited
}

{ [(column_list)]
{ VALUES ( { DEFAULT
| NULL
| expression
}[,...n]
)
| derived_table
| execute_statement
}
}
| DEFAULT VALUES



<table_hint_limited> ::=
{ INDEX(index_val [,...n])
| FASTFIRSTROW
| HOLDLOCK
| PAGLOCK
| READCOMMITTED
| REPEATABLEREAD
| ROWLOCK
| SERIALIZABLE
| TABLOCK
| TABLOCKX

UPDATE
{
table_name WITH ( <table_hint_limited> [...n])
| view_name
| rowset_function_limited
}
SET
{column_name = {expression | DEFAULT | NULL}
| @variable = expression
| @variable = column = expression } [,...n]

{{[FROM {<table_source>} [,...n] ]

[WHERE
<search_condition>] }
|
[WHERE CURRENT OF
{ { [GLOBAL] cursor_name } | cursor_variable_name}
] }
[OPTION (<query_hint> [,...n] )]


<table_source> ::=
table_name [ [AS] table_alias ] [ WITH ( <table_hint> [,...n]) ]
| view_name [ [AS] table_alias ]
| rowset_function [ [AS] table_alias ]
| derived_table [AS] table_alias [ (column_alias [,...n] ) ]
| <joined_table>

<joined_table> ::=
<table_source> <join_type> <table_source> ON <search_condition>
| <table_source> CROSS JOIN <table_source>
| <joined_table>

<join_type> ::=
[ INNER | { { LEFT | RIGHT | FULL } [OUTER] } ]
[ <join_hint> ]
JOIN


<table_hint_limited> ::=
{ INDEX(index_val [,...n])
| FASTFIRSTROW
| HOLDLOCK
| PAGLOCK
| READCOMMITTED
| REPEATABLEREAD
| ROWLOCK
| SERIALIZABLE
| TABLOCK
| TABLOCKX
}


<table_hint> ::=
{ INDEX(index_val [,...n])
| FASTFIRSTROW
| HOLDLOCK
| NOLOCK
| PAGLOCK
| READCOMMITTED
| READPAST
| READUNCOMMITTED
| REPEATABLEREAD
| ROWLOCK
| SERIALIZABLE
| TABLOCK
| TABLOCKX
| UPDLOCK
}


<query_hint> ::=
{ { HASH | ORDER } GROUP
| { CONCAT | HASH | MERGE } UNION
| {LOOP | MERGE | HASH} JOIN
| FAST number_rows
| FORCE ORDER
| MAXDOP
| ROBUST PLAN
| KEEP PLAN


luhongjun 2001-07-21
  • 打赏
  • 举报
回复
nononono(null,null):
老大,我手里没有《SQL Server Books Online》
告诉我下载地址,分数都给你.谢谢.
nononono 2001-07-21
  • 打赏
  • 举报
回复
能比《SQL Server Books Online》更权威更全面吗?
《SQL Server Books Online》同样满足你的要求:“这些语句完整的介绍”、“简单的说明及例子”
我一直想找一个通用性的过狗方法,预期是这个绕过方法不会涉及到下面3个方面 (1)中间件,如iis、apache (2)数据库,如mysql、sql server (3)脚本语言,如php、aspx、asp 网上关于安全狗的sql绕过研究,大多数是fuzz绕过的帖子,fuzz方法常常使用注释绕过,涉及到数据库特性,而且广泛用于注释语法的星号(*)可能会被网站自带的防恶意代码模块拦截了,在实践中体验不好。太多fuzz过waf的文章,多数是使用注释绕过,在我看来,所有fuzz绕过,本质就是正则匹配逃逸。 我计划写一篇脚本小子最爱的,涉及知识点最少,能直接放工具里全自动跑sql注入的过狗文章。 0x01 先说说安全狗是如何判断恶意代码 安全狗、云锁、D盾等软件waf,内置一套正则匹配检测规则。这类软件waf对恶意代码的认识很有限。例如安全狗iis版,只知道要防护的服务器是iis作为中间件,并不知道要防护的服务器上面部署的数据库类型[Mysql|Sql Server|Access..]以及脚本语言类型[php|aspx|asp...]。再者,由于是依靠正则规则看恶意代码,所以对恶意代码拦截不全面。 0x02 起因 某天,在本地搭建了一个Asp+Access+IIS环境,测试安全狗Bypass 用淘气字符串就绕过了安全狗的拦截。由于只能用在某些sql语句上,具体是哪一个字符串就无足轻重了。第一次在本地环境测试安全狗就绕过了,刚好那天看到论坛在征集优秀文章,计划着写处女作投稿。 附上地址,虽然字符串数量不多,但是确实很淘气... https://github.com/minimaxir/big-list-of-naughty-strings/blob/master/blns.txt 淘气字符串 我反复提交包含sql注入的数据包,Fuzz到了字符串[removed] 只有这一处,提示数据库报错了。那么,安全狗是分析到了什么?安全狗是用正则匹配看代码的,所看到,肯定不是一大串字符。反复删减,最终出来了 ///.js 0x03 绕过测试 ///.js js可以换成rm/wm/png/jpg等静态文件后缀 测试发现,只要url包含 ///.js 就会触发内置的白名单,直接被iis版安全狗放行。既然是触发白名单,我直接把http防护策略全部开启,把防护等级调到最高来测试效果。 http://192.168.29.131:8980/sql.php?id=1 and 1=1 (拦截) http://192.168.29.131:8980/sql.php?id=1 and 1=1&safe;=///.js? (放行) http://192.168.29.131:8980/sql.php/1.js?id=1 and 1=1 (放行) 触发白名单直接放行url,顺带放行了XSS攻击代码,连xss过狗代码也不用研究了,哈哈。 http://192.168.29.131:8980/sql.php?id=1 and 1=1&xss;=[removed]alert(/xss/)[removed]&safe;=///.js? (既有sql注入,又有xss攻击,放行) http://192.168.29.131:8980/sql.php?id=1 and 1=1&xss;=[removed] (很evil,也放行) 还能在url传输什么,放行恶意代码,脑洞... 不仅是放行url,连cookie位置也放行了。 但是当恶意代码放在post数据,就绕不过安全狗。 亲测,对于安全狗iis版,php,aspx,asp均能用这种方式过狗。 http://.../sql.php?safe=///.js?&id=1 http://.../sql.aspx?safe=///.js?&id=1 http://.../sql.asp?safe=///.js?&id=1 如果是Apache版安全狗,可以试试 http://.../sql.php/1.js?id=1 http://.../sql.aspx/1.js?id=1 备注:更新了图片,最新的iis版本,亲测,本文提供的两个方法 依然有效~~~ (思考花了一个星期,认认真真写稿也就两个晚上,8号的iis版已经更新了一次,然而漏洞依然存在,看来官方人员一直都不知道) 影响范围: 针对最新的安全狗iis版,从最右边开始匹配,存在某一个问号?附近的字符串满足正则表达式 \/.*?\/.*?\/.*?\.js(其中的js可以替换成如png、jpg等静态文件后缀)例如 ///.js?或http://ip/1.jpg? 就会触发内置白名单,无论数据库和脚本语言类型。触发白名单会放行url和cookie位置的恶意代码,但依然检查post的数据。 (Apache版的规则库不一样,手工测试出精简的字符串,但是url无效访问,所以Apache版的还只能按照http://.../sql.php/1.jpg?id=1触发白名单) 0x04 搜索公开技术贴 准备写稿了,防止遇到造轮子撞车,变换关键词,搜搜互联网最近半年的公开过狗技术帖。找到了一个造轮子的博客https://www.jianshu.com/p/507439c2dd94 看图。这个造轮子方法已经很普遍出现在各种BypassWaf文章里面。 我的观点:安全狗不认识什么是php,所以这个bypass没挖掘到绕过的本质。而且有些php网站不支持PATH_INFO特性。对问题本质的理解不一样,如果是思考如何触发安全狗的正则匹配规则,就能发现这个绕过方法可以推广到aspx和asp。 虽然方法很简单,发现了如何触发内置白名单,放行恶意代码,但是无法绕过恶意代码出现在post数据的情况。美中不足,思绪一度搁浅,因为我计划写一篇“脚本小子最爱,涉及知识点最少,能直接放工具里全自动跑sql注入的过狗文章”。 0x05 峰回路转 择日再度整理思路,翻看手里的资料。再次看到上次那个造轮子博客。看到0x04造轮子三个字,我在思考什么是造轮子?一味地造轮子本身没有错,错在看不到车子,不清楚什么轮子最适合,于是就有了四方形,三角形,椭圆形的轮子,同样都是能上路的轮子。我的思维跳跃到了那个经典的fuzz造轮子代码。曾经用这个代码Fuzz一个小时的我,就觉得fuzz代码对sql语句的理解不多,出现很多没必要的测试。 手工测试sql语句的经验告诉我,所有fuzz过狗payload本质都是正则匹配逃逸(包括特殊的截断),正则匹配逃逸的核心要点绝不是/××/注释。于是对造轮子作者的payload进行测试,发现最终有用的是#a (安全狗4.0) 所以说,注释绕过的是 # 配合 \n id=1 union select 1,2,3 (拦截) id=1 union# select 1,2,3 (拦截) id=1 union#a select 1,2,3 (放行) 原理:安全狗遇到注释符号 # 就会丢弃后边代码的检测。为了提防使用回车\n绕过正则过滤,只是拦截了# ,正则规则库没考虑到#+字符串+ 的情况,造成了BypassWaf 改写了个 tamper ,命名为Bypassdog40.py (成功测试了iis版安全狗4.0和apache版安全狗4.0) 核心代码只有一条,把所有空格替换为 #a if payload: retVal = re.sub(r"\s", r"#a ", payload) 执行 sqlmap -u “http://192.168.29.131:8980/sql.php?id=1” -v 3 --random-agent --tamper=Bypassdog40.py 成功跑出所有sql注入payload 紧接着又测试注入点在post和cookie的情况,自动化注入过程很顺利。 补充:安全狗Apache3.5 规则刚好相反,拦截#a ,放行# ,命名tamper为 Bypassdog35.py 0x06总结 真理总是直接,甚至是简单的 本文包含了两个过狗方法: 一个是触发内置白名单的正则规则,能放行url和cookie的恶意代码检测,包括了xss攻击。美中不足就是绕不过post数据的恶意代码检查。 另一个Bypass方法是传统方法,提供了很简单的tamper,核心代码只有一句,可以用sqlmap跑自动化,大致可以通杀安全狗。遇到无法读数据库情况,例如拦截了INFORMATION_SCHEMA,可以配合触发内置白名单的方法,直接放行。 MySQL #单行注释 -- 单行注释(特别注意,-- 后有个空格!!!) /*多行注释*/ MS SQL Server -- 单行注释 /*多行注释*/ Oracle REM单行注释 -- 单行注释 /*多行注释*/ 新的两个tamper命名为Bypassdog400 和Bypassdog350 适用于 MS SQL Server和Oracle

34,587

社区成员

发帖
与我相关
我的任务
社区描述
MS-SQL Server相关内容讨论专区
社区管理员
  • 基础类社区
  • 二月十六
  • 卖水果的net
加入社区
  • 近7日
  • 近30日
  • 至今
社区公告
暂无公告

试试用AI创作助手写篇文章吧