Remove garbage text from fields SQL server 2000

Question

I have a SQL server db that just got hacked. I am using
CFQUERYPARAM in all my queries, but somehow still got hacked. It
corrupted data and I know I can do a restore, but I don't want to
lost anything. How can I, for example, remove all garbage
characters to the right of a valid file name?
For example: poppies.png"></title><script src="
http://sdo.1000m
Only poppies.png is valid - the rest I need to remove. How
can I do this with a ColdFusion query? The double quote marks keep
throwing off anything I attempt.

Answer 1

Hi There, To clean up your data, you can select the records
with text you don't want in your database. Then loop through the
tables infected and run update query like this one below :
<cfloop example condition>
<cfquery name="UpdCleanDB" datasource="#Request.DSN#"
username="#Request.user#" password="#Request.pass#">
UPDATE TableName
SET InfectedColumnName
= REPLACE(InfectedColumnName,'"></title><script
src="
http://sdo.1000m','')
WHERE InfectedColumnName like
'%"></title><script src="
http://sdo.1000m%'
</cfquery>
</cfloop>
Either run this T-SQL on Sql Query Analyzer to clean your
data. Remember to Secure your application by setting the code below
into your Application.CFM file:
<!---SQL injection attack --->
<cfif FindNoCase("EXEC(", CGI.Query_String) OR
FindNoCase("EXEC(", CGI.Script_Name) OR FindNoCase("EXEC(",
CGI.Path_Info)>
<cfabort>
<cfelseif FindNoCase("CAST(", CGI.Query_String) OR
FindNoCase("CAST(", CGI.Script_Name) OR FindNoCase("CAST(",
CGI.Path_Info)>
<cfabort>
</cfif>
Hope that is well.
Regards,
Ortneil Kutama
Developer
Zimbabwe
Text