Punycode is a way to represent Unicode characters (including non-ASCII letters, symbols, and scripts) using only the limited set of ASCII characters (letters, digits, and hyphens). It's mainly used in the Domain Name System (DNS), which traditionally supports only ASCII. Punycode allows internationalized domain names (IDNs), so that domain names can include characters from many languages by converting them into a safe ASCII form. | Visible in Browser (IDN support) | Actual ASCII (Punycode) | | -------------------------------- | ----------------------- | | раypal.com | xn--ypal-43d9g.com | | paypal.com | paypal.com | In MySQL, similar character are treated as equal. This behavior can be abused in Password Reset, Forgot Password, and OAuth Provider sections.
SELECT 'a' = 'ᵃ';
+-------------+
| 'a' = 'ᵃ' |
+-------------+
| 1 |
+-------------+This trick works the SQL query uses `COLLATE utf8mb4_0900_as_cs`.
SELECT 'a' = 'ᵃ' COLLATE utf8mb4_0900_as_cs;
+----------------------------------------+
| 'a' = 'ᵃ' COLLATE utf8mb4_0900_as_cs |
+----------------------------------------+
| 0 |
+----------------------------------------+Source: Encoding Transformations/README.md in PayloadsAllTheThings. From PayloadsAllTheThings by Swissky and contributors. MIT License, Copyright (c) 2019 Swissky.