$name = $_GET['name'] Select * from table where name = '{$name}' Is there any way to exploit this kind of code, considering that it is part of a wordpress app (which mean quotes are being escaped) so stuff like this will not wok - Page.php?name='; drop table table; (php and mysql) I read about a vulnerability only on GBK charset - let say it uses a different charset. Does it mean that it is completely safe - can any one exploit it?
Although quotes are being escaped, it is still possible to exploit this kind of code if the input is not properly sanitized. Even if the quotes are being escaped, other characters such as semicolons, parentheses, and backticks can be used to inject malicious code. For example, an attacker could use the input ' OR 1=1;-- which would result in the following SQL query: Select * from table where name = '' OR 1=1;--' The double hyphen at the end of the query is used to comment out the remaining part of the original query, which prevents any syntax errors. Therefore, it is important to properly sanitize all user input, and to use prepared statements or parameterized queries instead of building SQL queries with user input. Regarding the vulnerability related to the GBK charset, it is specific to the way that character encoding is handled by MySQL. It is not related to WordPress or PHP. However, it is still important to properly sanitize all user input, regardless of the character encoding being used.
