diff --git a/src/main/java/com/alibaba/druid/sql/ast/SQLObject.java b/src/main/java/com/alibaba/druid/sql/ast/SQLObject.java
index 2662201982..c37294767f 100644
--- a/src/main/java/com/alibaba/druid/sql/ast/SQLObject.java
+++ b/src/main/java/com/alibaba/druid/sql/ast/SQLObject.java
@@ -28,6 +28,7 @@ public interface SQLObject {
     void                setParent(SQLObject parent);
 
     Map<String, Object> getAttributes();
+    boolean             containsAttribute(String name);
     Object              getAttribute(String name);
     void                putAttribute(String name, Object value);
     Map<String, Object> getAttributesDirect();
diff --git a/src/main/java/com/alibaba/druid/sql/ast/SQLObjectImpl.java b/src/main/java/com/alibaba/druid/sql/ast/SQLObjectImpl.java
index 8e4964d007..24e3022f71 100644
--- a/src/main/java/com/alibaba/druid/sql/ast/SQLObjectImpl.java
+++ b/src/main/java/com/alibaba/druid/sql/ast/SQLObjectImpl.java
@@ -88,6 +88,14 @@ public abstract class SQLObjectImpl implements SQLObject {
         return attributes;
     }
 
+    public boolean containsAttribute(String name) {
+        if (attributes == null) {
+            return false;
+        }
+
+        return attributes.containsKey(name);
+    }
+
     public Object getAttribute(String name) {
         if (attributes == null) {
             return null;
diff --git a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
index d91e2263df..3e5c5421c8 100644
--- a/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/sql/visitor/SQLEvalVisitorUtils.java
@@ -246,8 +246,8 @@ public class SQLEvalVisitorUtils {
         if (function != null) {
             Object result = function.eval(visitor, x);
 
-            if (result != SQLEvalVisitor.EVAL_ERROR) {
-                x.getAttributes().put(EVAL_VALUE, result);
+            if (result != SQLEvalVisitor.EVAL_ERROR && result != null) {
+                x.putAttribute(EVAL_VALUE, result);
             }
             return false;
         }
@@ -744,7 +744,7 @@ public class SQLEvalVisitorUtils {
     public static boolean visit(SQLEvalVisitor visitor, SQLInListExpr x) {
         SQLExpr valueExpr = x.getExpr();
         valueExpr.accept(visitor);
-        if (!valueExpr.getAttributes().containsKey(EVAL_VALUE)) {
+        if (!valueExpr.containsAttribute(EVAL_VALUE)) {
             return false;
         }
         Object value = valueExpr.getAttribute(EVAL_VALUE);
diff --git a/src/main/java/com/alibaba/druid/sql/visitor/functions/Concat.java b/src/main/java/com/alibaba/druid/sql/visitor/functions/Concat.java
index 275cffbe05..25c6259536 100644
--- a/src/main/java/com/alibaba/druid/sql/visitor/functions/Concat.java
+++ b/src/main/java/com/alibaba/druid/sql/visitor/functions/Concat.java
@@ -31,7 +31,7 @@ public class Concat implements Function {
         for (SQLExpr item : x.getParameters()) {
             item.accept(visitor);
 
-            Object itemValue = item.getAttributes().get(EVAL_VALUE);
+            Object itemValue = item.getAttribute(EVAL_VALUE);
             if (itemValue == null) {
                 return null;
             }
diff --git a/src/main/java/com/alibaba/druid/sql/visitor/functions/Elt.java b/src/main/java/com/alibaba/druid/sql/visitor/functions/Elt.java
index 6f9daafbc8..35cf95dabf 100644
--- a/src/main/java/com/alibaba/druid/sql/visitor/functions/Elt.java
+++ b/src/main/java/com/alibaba/druid/sql/visitor/functions/Elt.java
@@ -41,7 +41,7 @@ public class Elt implements Function {
         param0IntValue = ((Number) param0Value).intValue();
 
         if (param0IntValue >= x.getParameters().size()) {
-            return null;
+            return SQLEvalVisitor.EVAL_VALUE_NULL;
         }
 
         SQLExpr item = x.getParameters().get(param0IntValue);
diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index 80a059f655..dfd9ac6fa9 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -1573,7 +1573,7 @@ public class WallVisitorUtils {
     }
 
     public static Object getValue(WallVisitor visitor, SQLExpr x) {
-        if (x != null && x.getAttributes().containsKey(EVAL_VALUE)) {
+        if (x != null && x.containsAttribute(EVAL_VALUE)) {
             return getValueFromAttributes(visitor, x);
         }
 
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_select_2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_select_2.java
new file mode 100644
index 0000000000..e34995f04c
--- /dev/null
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/WallStatTest_select_2.java
@@ -0,0 +1,48 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import com.alibaba.druid.wall.WallContext;
+import com.alibaba.druid.wall.WallProvider;
+import com.alibaba.druid.wall.spi.MySqlWallProvider;
+import com.alibaba.druid.wall.spi.OracleWallProvider;
+import com.alibaba.druid.wall.spi.PGWallProvider;
+import com.alibaba.druid.wall.spi.SQLServerWallProvider;
+import junit.framework.TestCase;
+
+public class WallStatTest_select_2
+        extends TestCase {
+
+    private String sql = "SELECT *\n" +
+            "FROM `t`\n" +
+            "WHERE `t`.`col1` = '1'\n" +
+            "    AND `t`.`col2` = 0\n" +
+            "    AND CONCAT(t.col3, '_', t.col4) IN ('abc_def')";
+
+    protected void setUp() throws Exception {
+        WallContext.clearContext();
+    }
+
+    protected void tearDown() throws Exception {
+        WallContext.clearContext();
+    }
+
+    public void testMySql() throws Exception {
+        WallProvider provider = new MySqlWallProvider();
+        assertTrue(provider.checkValid(sql));
+    }
+
+    public void testOracle() throws Exception {
+        WallProvider provider = new OracleWallProvider();
+        assertTrue(provider.checkValid(sql));
+    }
+
+    public void testPG() throws Exception {
+        WallProvider provider = new PGWallProvider();
+        assertTrue(provider.checkValid(sql));
+    }
+
+    public void testSQLServer() throws Exception {
+        WallProvider provider = new SQLServerWallProvider();
+        assertTrue(provider.checkValid(sql));
+    }
+
+}