executing multi query in mysql_query() function

Question

suppose i have a query like this :

$std_id =   $_POST['std_id'];
$name   =   $_POST['name'];
$family =   $_POST['family'];

$sql    =   "insert into student set
 std_id =   $std_id,
 name   =   '$name',
 family =   '$family'"; 
$query  =   mysql_query($sql,$conn);

i read in a php security book that if user enter a value for family field like :

ahmad';drop database test#

can delete database test;

but we know that the mysql_query() function only allow to execute one query .
i want to know how can this input to be unsafe

possible duplicate of [Best way to stop SQL Injection in PHP](http://stackoverflow.com/questions/60174/best-way-to-stop-sql-injection-in-php) — Manse, Nov 26 '11 at 11:06
@ManseUK The question seems to be *not* about how to prevent SQL-injection, but how come that the `mysql_query()` function executes two statements in this scenario. — Quasdunk, Nov 26 '11 at 11:11
@Quasdunk SQL security is not always about running multiple statements - anything could be added to the end of that query that affects the insert — Manse, Nov 26 '11 at 11:12
well gee I hope you add more "security" to your code before it goes live... — Adam Fowler, Nov 26 '11 at 16:31

score 3 · Answer 1 · edited May 23 '17 at 10:34

Just worrying about multiple queries is not enough to protect SQL Security ... There are so many questions / answers on SO for you to read about this subject ..

Also good resources on php.net

score 3 · Accepted Answer · answered Nov 26 '11 at 11:12

There are many delusions in your question.
Let's sort them out.

mysql_query() doesn't support multiple queries execution.
(so, it is useless to delete anything)
dropping tables in the separate query is not the only way of the SQL injection.
(so, it is useless to delete anything again)
To protect your query you have to follow some well-known techniques, not some handmade inventions of doubtful efficiency.

score 0 · Answer 3 · answered Nov 26 '11 at 11:11

0

Using multiple queries separated by a semicolon is not the only way to exploit your queries, it is just a very simple example. It will work, when you are using mysqli_multi_query().

answered Nov 26 '11 at 11:11

str

42,689
17
109
127

I think that it is because the question was quite contrary - how to NOT to execute multiple queries – Your Common Sense Nov 26 '11 at 11:24
The question was "i want to know how can this input to be unsafe" which was answered. – str Nov 26 '11 at 11:30

executing multi query in mysql_query() function

3 Answers3