ql 서버 데이터베이스 주입 솔루션

 
  
declare @delStr nvarchar(500) 
  
set @delStr='' --          
  
/****************************************/ 
  
 
  
/**********       ************/ 
  
set nocount on 
  
 
  
declare @tableName nvarchar(100),@columnName nvarchar(100),@tbID int,@iRow int,@iResult int 
  
declare @sql nvarchar(2000) 
  
 
  
set @iResult=0 
  
declare cur cursor for 
  
select name,id from sysobjects where xtype='U' 
  
 
  
open cur 
  
fetch next from cur into @tableName,@tbID 
  
 
  
while @@fetch_status=0 
  
begin 
  
declare cur1 cursor for 
  
select name from syscolumns where xtype in (231,167,239,175, 35, 99) and id=@tbID 
  
open cur1 
  
fetch next from cur1 into @columnName 
  
while @@fetch_status=0 
  
begin 
  
set @sql='update [' + @tableName + '] set ['+ @columnName +']= SUBSTRING([' + @columnName + '],' + '1, PATINDEX( ''%' + @delStr + '%'', [' + @columnName + '])-1) + ' + 'SUBSTRING([' + @columnName + '], PATINDEX( ''%' + @delStr + '%'', [' + @columnName + ']) + ' + 'len(''' + @delStr + ''') , datalength([' + @columnName + '])) where ['+@columnName+'] like ''%'+@delStr+'%''' 
  
 
  
exec sp_executesql @sql 
  
set @iRow=@@rowcount 
  
set @iResult=@iResult+@iRow 
  
if @iRow>0 
  
begin 
  
print ' ：'+@tableName+', :'+@columnName+'   '+convert(varchar(10),@iRow)+'   ;' 
  
end 
  
fetch next from cur1 into @columnName 
  
 
  
 
  
end 
  
close cur1 
  
deallocate cur1 
  
 
  
fetch next from cur into @tableName,@tbID 
  
end 
  
print '     '+convert(varchar(10),@iResult)+'      !!!' 
  
 
  
close cur 
  
deallocate cur 
  
set nocount off