Can SQL Injection Bypass `mysql_real_escape_string()` Using Character Set Manipulation?

SQL Injection That Evades mysql_real_escape_string()

Despite its widespread use, mysql_real_escape_string() is not immune to SQL injection attacks.

The Attack

Requirement: The database connection must use a vulnerable character set like big5, cp932, gb2312, gbk, or sjis.

Steps:

1. Set the encoding: Set the server encoding to a vulnerable character set using SET NAMES.
2. Construct the payload: Create a payload that includes an invalid multibyte character, e.g., 0xbf27, in the vulnerable character set.
3. Escape using mysql_real_escape_string(): Escape the payload using mysql_real_escape_string(), which will insert a backslash before the initial byte i.e. 0x27.
4. Interrogate the database: Use the escaped payload in a query.

Result: Due to the client-server encoding mismatch, the query contains a unescaped single quote, resulting in a successful SQL injection.

The Ugly

Bug in mysql_real_escape_string(): In earlier MySQL versions, invalid multibyte characters were treated as single bytes for escaping purposes, even if the client was aware of the connection encoding.

PDO vulnerability: Emulated prepared statements in PDO are constructed using mysql_real_escape_string() and are therefore vulnerable to this attack.

The Saving Grace

Safe practices:

• Use a non-vulnerable character set like utf8 or latin1.
• Set the character set correctly on both the client and server.
• Disable emulated prepared statements in PDO.

The above is the detailed content of Can SQL Injection Bypass `mysql_real_escape_string()` Using Character Set Manipulation?. For more information, please follow other related articles on the PHP Chinese website!