Wide-byte SQL injection

The principle of injection production:

The database is set to GBK encoding:

Wide-byte injection stems from the programmer setting the MySQL connection with an error configured as: Set CHARACTER_SET_CLIENT=GBK, which causes an injection vulnerability caused by the encoding conversion.

1, under normal circumstances, when the GPC open or use the Addslashes function will filter the GET or post submitted parameters, the hacker used by the single quotation mark (') will be escaped to: \ ';

2, but if there is wide-byte injection, when we enter%df%27, we first go through the above-mentioned single-quote escape into the%df%5c%27 (%5c is a backslash), and then in the database query

Before the GBK multibyte encoding was used, that is, the two bytes in the Chinese character coding range are encoded into a Chinese character. This creates an injection vulnerability.

The database is set to UTF-8 encoding:

Utf-8 Turn GBK

Here think of the word "Jin", its utf-8 code is E98CA6, its GBK code is%e5%5c, and the above mentioned backslash \ exactly for%5c. So if we set the title

As: ' Kam ', first through the addlashes function or GPC to the single-quote escape to: Kam \ ', and then through the ICONV function will be "Kam" to GBK encoding, and finally%e5%5c%5c%27.

The backslash is escaped (%5c%5c), which causes an injection vulnerability when the single quote escapes.

Wide-byte SQL injection