executing multi query in mysql_query() function

Question

suppose i have a query like this :

$std_id =   $_POST['std_id'];
$name   =   $_POST['name'];
$family =   $_POST['family'];

$sql    =   "insert into student set
 std_id =   $std_id,
 name   =   '$name',
 family =   '$family'"; 
$query  =   mysql_query($sql,$conn);

i read in a php security book that if user enter a value for family field like :

ahmad';drop database test#

can delete database test;

but we know that the mysql_query() function only allow to execute one query .
i want to know how can this input to be unsafe

@ManseUK The question seems to be not about how to prevent SQL-injection, but how come that the mysql_query() function executes two statements in this scenario. — Quasdunk
– Quasdunk, Commented Nov 26, 2011 at 11:11
@Quasdunk SQL security is not always about running multiple statements - anything could be added to the end of that query that affects the insert — Manse
– Manse, Commented Nov 26, 2011 at 11:12
well gee I hope you add more "security" to your code before it goes live... — Adam Fowler
– Adam Fowler, Commented Nov 26, 2011 at 16:31

Your Common Sense · Accepted Answer · 2011-11-26 11:12:43Z

3

There are many delusions in your question.
Let's sort them out.

mysql_query() doesn't support multiple queries execution.
(so, it is useless to delete anything)
dropping tables in the separate query is not the only way of the SQL injection.
(so, it is useless to delete anything again)
To protect your query you have to follow some well-known techniques, not some handmade inventions of doubtful efficiency.

answered Nov 26, 2011 at 11:12

Your Common Sense

158k42 gold badges226 silver badges373 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Community · Accepted Answer · 2017-05-23 10:34:23Z

3

Just worrying about multiple queries is not enough to protect SQL Security ... There are so many questions / answers on SO for you to read about this subject ..

Also good resources on php.net

edited May 23, 2017 at 10:34

CommunityBot

11 silver badge

answered Nov 26, 2011 at 11:08

Manse

38.1k11 gold badges88 silver badges112 bronze badges

Comments

str · Accepted Answer · 2011-11-26 11:11:16Z

0

Using multiple queries separated by a semicolon is not the only way to exploit your queries, it is just a very simple example. It will work, when you are using mysqli_multi_query().

answered Nov 26, 2011 at 11:11

str

45.5k18 gold badges117 silver badges134 bronze badges

2 Comments

Your Common Sense Over a year ago

I think that it is because the question was quite contrary - how to NOT to execute multiple queries

str Over a year ago

The question was "i want to know how can this input to be unsafe" which was answered.

Collectives™ on Stack Overflow

executing multi query in mysql_query() function

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

Comments

Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related