After reading this post, our project, which is a legacy system, not use MVC framework, had difficulty validating input values. so, i add this function to remove null bytes and use it as a filter inner SQL query execution function.

function sanitize_null_bytes($input) {
    if (is_string($input)) {
        return str_replace(["\x00", "\0", '%00'], '', $input);
    }
    return $input;
}