InstantForum.NET v2.9.0SQLServerCentralhttp://www.sqlservercentral.com/Forums/notifications@sqlservercentral.comThu, 23 May 2013 13:48:22 GMT20http://www.sqlservercentral.com/Forums/Topic419243-8-1.aspxI got something similar which is just a plain query, not a tool or a sProc.[url=http://fullparam.wordpress.com/2012/09/07/fck-it-i-am-going-to-search-all-tables-all-collumns/][/url]Mon, 10 Dec 2012 10:54:54 GMTregeterhttp://www.sqlservercentral.com/Forums/Topic419243-8-1.aspxHere is a tool you can try (Free). [url=http://www.sqlmgmt.com/ProductDetail.aspx?Id=101]http://www.sqlmgmt.com/ProductDetail.aspx?Id=101[/url]This tool helps you to search all columns of all tables in a database for a string keyword. In order to increase performance, it examines string type columns only in all tables to search for a given keyword.Mon, 13 Jun 2011 22:28:52 GMTedyleehttp://www.sqlservercentral.com/Forums/Topic419243-8-1.aspxhere's something i use, and i'm sure i'm stating the obvious and what you already did tog et back up and running, but you'd be best off doing a back up, restoring a previous database, and then compare corrupted vs production.there's no built in tool to test for sql injection, you;l need to go thru your code.CREATE PROCEDURE UGLYSEARCH -- EXEC UGLYSEARCH 'TEST'@SEARCHSTRING VARCHAR(50)ASSET NOCOUNT ONDECLARE @SQL VARCHAR(500),@TABLENAME VARCHAR(60),@COLUMNNAME VARCHAR(60)CREATE TABLE #RESULTS(TBLNAME VARCHAR(60),COLNAME VARCHAR(60),SQL VARCHAR(600))SELECT SYSOBJECTS.NAME AS TBLNAME, SYSCOLUMNS.NAME AS COLNAME, TYPE_NAME(SYSCOLUMNS.XTYPE) AS DATATYPE INTO #FKFINDER FROM SYSOBJECTS INNER JOIN SYSCOLUMNS ON SYSOBJECTS.ID=SYSCOLUMNS.ID WHERE SYSOBJECTS.XTYPE='U' AND TYPE_NAME(SYSCOLUMNS.XTYPE) IN ('VARCHAR','NVARCHAR','CHAR','NCHAR') ORDER BY TBLNAME,COLNAMEDECLARE C1 CURSOR FOR SELECT TBLNAME,COLNAME FROM #FKFINDER ORDER BY TBLNAME,COLNAMEOPEN C1FETCH NEXT FROM C1 INTO @TABLENAME,@COLUMNNAMEWHILE @@FETCH_STATUS <> -1 BEGIN --SET @SQL = 'SELECT ''' + @TABLENAME + ''' AS TABLENAME,''' + @COLUMNNAME + ''' AS COLUMNNAME,* FROM ' + @TABLENAME + ' WHERE ' + @COLUMNNAME + ' LIKE ''%' + @SEARCHSTRING + '%''' SET @SQL = 'IF EXISTS(SELECT * FROM ' + @TABLENAME + ' WHERE ' + @COLUMNNAME + ' LIKE ''%' + @SEARCHSTRING + '%'') INSERT INTO #RESULTS(TBLNAME,COLNAME,SQL) VALUES(''' + @TABLENAME + ''',''' + @COLUMNNAME + ''','' SELECT * FROM ' + @TABLENAME + ' WHERE ' + @COLUMNNAME + ' LIKE ''''' + @SEARCHSTRING + ''''' '') ;' PRINT @SQL EXEC (@SQL)FETCH NEXT FROM C1 INTO @TABLENAME,@COLUMNNAME ENDCLOSE C1DEALLOCATE C1SELECT * FROM #RESULTSTue, 06 Nov 2007 13:35:22 GMTLowellhttp://www.sqlservercentral.com/Forums/Topic419243-8-1.aspxThis one is useful link to search and replace SQL Server data in all columns of all tables, in a given database?http://vyaskn.tripod.com/sql_server_search_and_replace.htm:)Tue, 06 Nov 2007 12:55:23 GMTVenkataraman-408293http://www.sqlservercentral.com/Forums/Topic419243-8-1.aspxHi Experts,Is there a way to find specific string in data in all the user tables, not column names or stored procedures? Can some one please help? Also, one of our websites was hacked by someone. I believe that they use SQL injection to do so. Is there anyway/tool to check for SQL vulnerbilities?Any inputs will be very appreciated.Thanks,MinhTue, 06 Nov 2007 12:26:58 GMTjoemai