Can SQL Injection Bypass `mysql_real_escape_string()` Under Specific Character Set Conditions?

SQL injection that bypasses mysql_real_escape_string() under certain circumstances

Although mysql_real_escape_string() is generally believed to eliminate SQL injection vulnerabilities, it may still be bypassed in some special cases.

Vulnerability Analysis

Under certain scenarios, an attacker can exploit a flaw in mysql_real_escape_string() that occurs when the character set of the database connection is chosen to support both ASCII characters' and '(e.g., gbk, sjks).

An attacker can construct a payload containing an invalid multibyte character sequence (e.g., xbfx27), which when processed through mysql_real_escape_string() results in an unescaped ' character. Therefore, when inserted into a query, it results in SQL injection.

Example

Consider the following PHP code:

$login = mysql_real_escape_string($_POST['login']);
$password = mysql_real_escape_string($_POST['password']);

$sql = "SELECT * FROM table WHERE login='$login' AND password='$password'";

If an attacker sets the value of $_POST['login'] to \xbf\x27 OR 1=1 /*, they can bypass the protection of mysql_real_escape_string() and retrieve all rows in the table.

Mitigation Measures

To mitigate this vulnerability, be sure to:

• Upgrade to a newer MySQL version: Newer MySQL versions (for example, MySQL 5.1) contain a fix for this specific issue.
• Use a safe charset: Use a charset that does not support ' and ' as a valid character (e.g., utf8, latin1).
• Disable emulated prepared statements in PDO: Set PDO::ATTR_EMULATE_PREPARES to false to force the use of real prepared statements.
• Set the character set correctly: Explicitly set the character set of the database connection using mysql_set_charset() or the DSN character set parameter of PDO.
• Use SQL mode 'NO_BACKSLASH_ESCAPES' (use with caution): This SQL mode mitigates this specific vulnerability by preventing valid characters from being created during escaping. However, be aware of potential side effects.

The above is the detailed content of Can SQL Injection Bypass `mysql_real_escape_string()` Under Specific Character Set Conditions?. For more information, please follow other related articles on the PHP Chinese website!