SQL Inject 除去惡意碼


Declare @T Varchar(255),@C Varchar(255)
Declare Table_Cursor
Cursor For Select A.Name,B.Name From Sysobjects A,Syscolumns B
Where A.Id=B.Id And A.Xtype='u' And
(B.Xtype=99 Or B.Xtype=35 Or B.Xtype=231 Or B.Xtype=167)
Open Table_Cursor Fetch Next From Table_Cursor Into @T,@C
While(@@Fetch_Status=0)
Begin
exec('update ['+@T+'] Set ['+@C+']=Replace(['+@C+'],''骯髒的碼'','''')')
Fetch Next From Table_Cursor Into @T,@C
End Close Table_Cursor Deallocate Table_Cursor


參考文章:
http://www.dotblogs.com.tw/dotjum/archive/2009/08/02/9808.aspx