今天sql注入了，怎么批量修改！

[ivanbf]

太多了 简直是惨不忍睹啊 怎么批量更改 越简单越好 谢谢了

[--小F--]

去精华帖子里面搜索SQL注入的帖子看看

[子陌红尘]

前不久刚刚回复了一个类似问题的帖子：
http://topic.csdn.net/u/20090427/01/2a55eef7-0d8a-47db-9c73-8ef6da4cb8d6.html

Declare @T Varchar(1000),@C Varchar(1000) 
Declare Table_Cursor Cursor For 
Select A.Name,B.Name From Sysobjects A,Syscolumns B 
Where A.Id=B.Id And A.Xtype='u' And (B.Xtype=99 Or B.Xtype=35 Or B.Xtype=231 Or B.Xtype=167) 

Open Table_Cursor 
Fetch Next From  Table_Cursor Into @T,@C 

While(@@Fetch_Status=0) 
Begin 
    Exec('update ['+@T+'] Set ['+@C+']=replace(['+@C+'],''<script src=http://3b3.org/c.js> </script>'','''')')
    Fetch Next From  Table_Cursor Into @T,@C 
End 
Close Table_Cursor 
Deallocate Table_Cursor

[ivanbf]

恩 谢谢ls 我先去看看

[htl258_Tony]

declare @delStr varchar(8000)
set @delStr='<script src=http://3%62omb.com/c.js></script>'
set @delStr='<script src=http://3bomb.%63%6Fm/c.js></script>'
set @delStr='<script src=http://3b%6F%6Db.com/c.js></script>'
set @delStr='<script src=http://%33bomb.com/c.js></script>'
set @delStr='<script src=http://3bomb.co%6D/c.js></script>'
set @delStr='<script src=http://3bom%62%2Ecom/c.js></script>'
set @delStr='<script src=http://3b%6Fmb.com/c.js></script>'
set @delStr='<script src=http://3bomb.c%6Fm/c.js></script>'
set @delStr='<script src=http://%33%62omb.com/c.js></script>'


set nocount on

declare @tableName nvarchar(100),@columnName nvarchar(100),@tbID int,@iRow int,@iResult int
declare @sql nvarchar(500)

set @iResult=0
declare cur cursor for
select name,id from sysobjects where xtype='U'

open cur
fetch next from cur into @tableName,@tbID

while @@fetch_status=0
begin
declare cur1 cursor for
        --xtype in (231,167,239,175,99,35) 为char,varchar,nchar,nvarchar,ntext,text类型
        select name from syscolumns where xtype in (231,167,239,175,99,35) and id=@tbID
open cur1
fetch next from cur1 into @columnName
while @@fetch_status=0
begin
      set @sql='update [' + @tableName + '] set ['+ @columnName +']= replace(cast(['+@columnName+'] as varchar(8000)),'''+@delStr+''','''') where ['+@columnName+'] like ''%'+@delStr+'%'''
      --update tablename set fieldA=replace(cast(fieldA as varchar(8000)) ,'aa','bb')这样的语句。
      exec sp_executesql @sql    
      set @iRow=@@rowcount
      set @iResult=@iResult+@iRow
      if @iRow>0
      begin
print '表：'+@tableName+',列:'+@columnName+'被更新'+convert(varchar(10),@iRow)+'条记录;'
      end    
      fetch next from cur1 into @columnName


end
close cur1
deallocate cur1

fetch next from cur into @tableName,@tbID
end
print '数据库共有'+convert(varchar(10),@iResult)+'条记录被更新!!!'

close cur
deallocate cur
set nocount off

[ivanbf]

大家好热情啊 呵呵

[ivanbf]

问题解决 呵呵 谢谢大家