Collected research
Novel SQL Injection Technique in PDO Prepared Statements
PDO emulates prepared statements by default and parses the SQL with its own scanner. A null byte makes that scanner abandon a backtick-quoted identifier, so an attacker's question mark inside a column name becomes a bound parameter and a second user-controlled value is substituted unescaped, giving SQL injection where escaping looked correct.
Record
- Researcher
- Adam Kues and @searchlightsec
- Published by
- Searchlight Cyber
- Date
- Topic
- Injection
In the archive
Tags
This page is the archive's own catalogue record. The research is the work of Adam Kues and @searchlightsec, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on .