This is not really SC related, but a generic problem. The database should always listen to localhost and nothing more, to avoid a direct attack on the database. So malicious data can only be entered by flaws in your application, like XSS and SQL injection. If your field is large enough to store javascript then you must take measures to prevent. Some generators are protected automatically that even stored javascript in the database will be displayed as text and gets not executed. Now back to your question, If you have issues with your database, then restoring is not so simple. Depending on when the data was entered, I doubt if you will find that data easily. If it is just a record, you might manually fix the issue. Backups might contain the same bad data, so you can never be sure, unless you have an automated date/time stamp, so you can trace back when it happend. But suppose a month ago, you cannot ‘just’ go back in your backups for a month. If you know the record, and you have a decent audit trail then you might want to recover from there. But only if the crap was inserted using your application. Then you have the values of the old- and new record. I do it that way, but fortunately never had to use it for recovery. But if your database was directly compromised, or updated by some other process, then I don’t see an automated way.
