title: MySQL injection query
body: <p>I'm familiar with prepared statements and I know that they are best practice when it comes to protecting against MySQL injection. But I'm wondering how this PHP/MySQL statement could be at risk of an injection attack:</p>
  
  <pre><code>$result = mysqli_query($db,"SELECT name FROM users WHERE id = '".$_POST['name']."';");
  </code></pre>
  
  <p>It seems to me like the input from the user would be contained inside the single quotes. Can you execute more than one query in one <code>mysqli_query</code> statement?</p>
  
  <p>Also, is making the above safe just as easy as this...</p>
  
  <pre><code>$result = mysqli_query($db,"SELECT name FROM users WHERE id = '".mysqli_real_escape_string($_POST['name'])."';");
  </code></pre>