剑锋博客

数据库被注入以后，要手工删除被非法注入的信息是痛苦的事情，下面这个存储过程可以帮你一键搞定。

SET ANSI_NULLS ON
GO

SET QUOTED_IDENTIFIER ON
GO

create proc [dbo].[ReplaceKeyWord]

@old nvarchar(100),

@new nvarchar(100)

as

declare @sql nvarchar(1000)

set @sql=N' 

declare   @s   nvarchar(4000),@tbname   sysname 

select   @s=N'''',@tbname=N''?'' 

select   @s=@s+N'',''+quotename(a.name)+N''=replace(''+quotename(a.name)+N'',N'''''+@old+''''',N'''''+@new+''''')'' 

from   syscolumns   a,systypes   b 

where   a.id=object_id(@tbname)    

and   a.xusertype=b.xusertype 

and   b.name   like   N''%char'' 

if   @@rowcount>0 

begin 

set   @s=stuff(@s,1,1,N'''') 

exec(N''update   ''+@tbname+''   set   ''+@s) 

end '

--print @sql

exec   sp_msforeachtable   @sql;

set @sql=N' 

declare   @s   nvarchar(4000),@tbname   sysname 

select   @s=N'''',@tbname=N''?'' 

select   @s=@s+quotename(a.name)+N'',''

from   syscolumns   a,systypes   b 

where   a.id=object_id(@tbname)    

and   a.xusertype=b.xusertype 

and   b.name   like   N''%text'' 

if   @@rowcount>0 

begin 

exec UpdateTextColumn @tbname,@s,'''+@old+''','''+@new+'''

end

' ;

exec   sp_msforeachtable @sql
GO

用法：

exec ReplaceKeyWord '替换前字符串','替换后的字符串';