The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below:

SELECT * FROM `table` WHERE `column` = "�½��ļ���.zip"

Does this imply that this query is vulnerable to SQL Injection? If not, is there any disclosure or other vulnerability that this input may provide the attacker?

Edit: This particular request appears to have come from Acunetix Vulnerability Scanner. If this is accurate, there must be some value to an attacker in providing this value in a request. What results might the scanner have been expecting?

  • 2
    No it does not indicate SQL injection. This error simply states that two strings of incompatible collations are being compared. In this scenario the input with the column data.
    – Technidev
    Commented Apr 23, 2018 at 19:41
  • That said you should use prepared-statements
    – Nir Alfasi
    Commented Apr 24, 2018 at 23:18


You must log in to answer this question.

Browse other questions tagged .