Wide byte injection

When you use PHP and MySQL, setting "SETCHARACTER_SET_CLIENT=GBK" may result in wide byte injection. The principle of wide byte injection is such that when the 1.php?id=1 is submitted, if the MySQL statement is "SELECT * from user where id= ' 1", when the parameter is used Addslashes (), mysql_escape_string () Alternatively, the GPC switch filters single quotes ('), double quotes ("), backslashes (\), and null characters, which are escaped by preceding the symbols with a backslash, as follows:

<?php
	Header ("content-type:text/html; Charset=utf-8 ");
	$conn = mysql_connect (' localhost ', ' root ', ' root ');
	mysql_select_db ("Test", $conn);
	mysql_query ("SET NAMES GBK", $conn);	Unsafe encoding method

	$id = addslashes ($_get[' id '));			Unsafe escape function
	$sql = "SELECT * from Test where id= ' $id '";
	$query = mysql_query ($sql, $conn);
	if ($query = = True)
	{
		$result = mysql_fetch_array ($query);
		$user = $result ["user"];
		$email = $result ["email"];

		Print_r (' username: '. $user. ' <br/> ');
		Print_r (' Postal  box: '. $email. ' <br/> ');
		$sql = mb_convert_encoding ($sql, "UTF-8", "GBK");
		Print_r (' <br/>sql statement: '. $sql);
		
	}

	Mysql_close ($conn);

Single quotes are not closed and cannot be injected. After we add%df%27 to the parameters, we can%5c the program to eat it. This is because the%DF and the combination of%df%5c, decoded into the word "run", followed by the%27 (single quotes) has not been escaped, the successful implementation of the closure. As follows:

The vulnerability arises because "SETCHARACTER_SET_CLIENT=GBK", such as "Set NAMES GBK", is executed when PHP connects to MySQL, in effect doing the following:

Set character_set_connection = GBK,

Set CHARACTER_SET_RESULTS=GBK,

Set CHARACTER_SET_CLIENT=GBK

and Mysql_set_charset (' GBK ') actually calls the set NAMES, so there are also vulnerabilities. The same Code conversion function Iconv (), mb_convert_encoding () and so on can also create vulnerabilities.

There are several ways to prevent vulnerabilities:

1 perform the following operations before executing the query: SET NAMES GBK; Character_set_client=binary.

2) using mysql_real_escape_string () security escape function for parameter filtering.

3 Use the PDO method to precompile and process database queries.