https://kakatoji.blogspot.com/2017/03/sql-injection-with-mixed-urlencode.html