Search code examples
urlencodingsql-injectionbots

Strange URL containing 'A=0 or '0=A in web server logs

During the last weekend some of my sites logged errors implying wrong usage of our URLs:

...news.php?lang=EN&id=23'A=0

or

...news.php?lang=EN&id=23'0=A

instead of

...news.php?lang=EN&id=23

I found only one page originally which mentioned this (https://forums.adobe.com/thread/1973913) where they speculated that the additional query string comes from GoogleBot or an encoding error.

I recently changed my sites to use PDO instead of mysql_*. Maybe this change caused the errors? Any hints would be useful.

Additionally, all of the requests come from the same user-agent shown below.

Mozilla/5.0 (Windows; U; Windows NT 5.1; pt-PT; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 (.NET CLR 3.5.30729)

This lead me to find the following threads: pt-BR and Strange parameter in URL - what are they trying?

Solution

  • since this is a very old version of FireFox, I blocked it in my htaccess file -

    RewriteCond %{HTTP_USER_AGENT} Firefox/3\.5\.2 [NC]
RewriteRule .* err404.php  [R,L]