Hi.
what is wrong with the following query, which can not be executed:

$query = "SELECT id, firstName, lastName, username, password FROM users WHERE username = '' OR '1' AND password = '' OR '1' ; DELETE FROM users WHERE 1 or username = ' ' ";
$result = mysql_query($query);

Dani AI

Generated

Short version: the approach in the original post runs into two separate problems — the older mysql API and unsafe testing practices. As hinted, that API is not suited for sending arbitrary semicolon-separated statements in one shot; also the old ext/mysql is removed in modern PHP, so new code should use PDO or MySQLi instead (). If you truly need to run multiple statements in one call, MySQLi exposes mysqli::multi_query, but it requires careful result-set handling and is generally unnecessary for normal workflows (mysqli::multi_query).

Practical, safer steps to apply right now: 1) Move to parameterized queries (PDO or MySQLi prepared statements) so user input cannot corrupt SQL; follow the OWASP prevention guidance for SQL injection. 2) Run each logical SQL operation in its own API call or use transactions to keep multi-step changes atomic. 3) Test only on isolated, backed-up development copies (local VM or disposable container) and avoid experimenting on production data. 4) Use clear error checking and logging so you can see why a statement failed instead of sending many statements at once.

For a next action: refactor the example to use prepared statements and execute two separate statements (or a transaction) rather than concatenating semicolons. See the PDO and MySQLi docs for patterns and the OWASP cheat sheet for prevention techniques (SQL Injection Prevention Cheat Sheet).

Recommended Answers

All 7 Replies

any idea plz???

you cannot execute two queries what way. mysql_query only accepts one. you need to run two seperate queries.

Thanks for relpying ...

Umm.. just curious.. Are you trying sql injection ?

yeah, I want to test on my system, to see the results ... but unfortunately it is not working ...

do u have any idea? I am using the POST method...

No :(

and all the faith i had in nav33n. im crushed lol.

i have taken a look into sql injection and from what i have seen you are doing it correctly (i think).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.