2

I read this answer, It explains how a multi-byte character exploit works in a decent way, the only way I could think of avoiding this problem is whitelisting all single-byte characters because of the fact, as D.W. mentioned in the linked answer, that

there are also multi-byte sequences that the database might decode as a single quote, and that do not contain the 0x27 byte or any other suspicious byte value. As a result, standard quote-escaping functions may fail to escape those quotes.

Can anyone suggest some other way to tackle this problem?

1 Answers1

2

Parameterized queries solve this problem as it separates the parsing of the query from the handling of user supplied data.

wireghoul
  • 5,745
  • 2
  • 17
  • 26