Preliminary research

Hack the Elephant One Bite at a Time: NUL byte SQL Injection in pdo_firebird

Aleksey Solovev and Nikita Sveshnikov · PT SWARM

AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.

Traces Firebird PDO query reconstruction through NUL-terminated string operations. A quoted binary token loses its closing quote while reconstruction resumes at later tokens, making subsequent input become SQL syntax before native preparation. The article also examines a separate PDO PostgreSQL null-pointer failure.

Record

Researcher

Aleksey Solovev and Nikita Sveshnikov

Published by

PT SWARM

In the archive

• Collected in the 2026 preliminary research sweep

Related sources

• Related PDO investigation
• Related finding advisory
• PDO Firebird advisory
• PDO quoting advisory

Tags

• php
• sqli
• parser-differential
• database
• dos
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Aleksey Solovev and Nikita Sveshnikov, first published at the original source. Preserved copies are kept so the citation survives its host.