SQL Injection 공격 복구 쿼리문

DECLARE @TP  int; 
DECLARE @TBL varchar(255), @CLN varchar(255),  @DEL_STR varchar(255); 
SET @DEL_STR='sr'    // 삭제할 내용을 적어주면 됩니다.

 

DECLARE Table_Cursor CURSOR FOR 
SELECT a.name, b.name ,b.xtype 
FROM sysobjects a, syscolumns b 
WHERE a.id = b.id AND a.xtype = 'u' AND 
(b.xtype = 99 OR b.xtype = 35 OR b.xtype = 231 OR b.xtype = 167  OR b.xtype=175  OR b.xtype=239 );

 

OPEN Table_Cursor;

 

FETCH NEXT FROM Table_Cursor INTO @TBL, @CLN, @TP; 
WHILE (@@FETCH_STATUS = 0) BEGIN 
    IF  @TP  > 100 
    BEGIN 
  --select @TBL
        EXEC('UPDATE ['+ @TBL +'] set [' + @CLN + '] = REPLACE(convert(varchar, '+ @CLN+') , '''+@DEL_STR +''','''' )'); 
    END 
    ELSE 
    BEGIN
  --select @TBL
        EXEC('UPDATE ['+ @TBL +'] set [' + @CLN + '] = REPLACE(CONVERT(varchar,'+ @CLN+') , '''+@DEL_STR +''','''' )'); 
    END 
FETCH NEXT FROM Table_Cursor INTO @TBL, @CLN,@TP; 
END;

 

CLOSE Table_Cursor; 
DEALLOCATE Table_Cursor;