It's sad to see this mistake being made repeatedly. It kind of works like this<p><pre><code> 1) Small project started, MySQL is used because that's all the developer knows
or it's convenient
2) Strict mode is never turned on; developer has no idea it exists
3) App gets popular
4) Too late to enable Strict
</code></pre>
It's really the main reason why I don't recommend MySQL. Theres so many mistakes waiting to be made.
Why why why did MySQL have to win the damn race. It's the PHP of databases: it more or less works, but you're relying on a cardboard skyscraper built on a foundation of poop. And this <i>will</i> come back to bite you.<p>Why MySQL Is Not My Favourite Database: <a href="https://reddragdiva.dreamwidth.org/593924.html" rel="nofollow">https://reddragdiva.dreamwidth.org/593924.html</a>
For anyone interested in knowing how the UTF8 attack works, Mathias Bynens has a fantastic presentation which describes the technical details: <a href="https://www.youtube.com/watch?v=qFfjJ8pOrWY" rel="nofollow">https://www.youtube.com/watch?v=qFfjJ8pOrWY</a><p>Here's the slide deck: <a href="https://speakerdeck.com/mathiasbynens/hacking-with-unicode" rel="nofollow">https://speakerdeck.com/mathiasbynens/hacking-with-unicode</a><p>Interesting anecdote from the talk: This isn't just unique to Wordpress. Spotify was vulnerable to this at one point.