The user input of a given query is being sanitized (PHP, real_escape_string), yet the query fails with "Illegal mix of collations". This query is below:

SELECT * FROM `table` WHERE `column` = "�½��ļ���.zip"

Does this imply that this query is vulnerable to SQL Injection? If not, is there any disclosure or other vulnerability that this input may provide the attacker?

Edit: This particular request appears to have come from Acunetix Vulnerability Scanner. If this is accurate, there must be some value to an attacker in providing this value in a request. What results might the scanner have been expecting?

  • 2
    No it does not indicate SQL injection. This error simply states that two strings of incompatible collations are being compared. In this scenario the input with the column data. – Technidev Apr 23 '18 at 19:41
  • That said you should use prepared-statements – alfasin Apr 24 '18 at 23:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.