title: SQL Injection : Syntax error
body: <p>I have an essay on SQL injection ( what it is - how its done and how can it be avoided ). I get what it is and how it works. But i dont seem to be able to reproduce an injection on my database. </p>
  
  <p>I made a pretty simple database ,using mysql workbench, meant for a video club. movies - stock - price - customers shopping cart etc. 
  I also made a pretty simple html page from which i can add movies - view what i have in stock etc. </p>
  
  <p>So i have a txt field in which i enter a movie name and i get back some info for this specific movie. </p>
  
  <p>The code that gets the name i type and makes the query is ::</p>
  
  <pre><code>$name = $_POST ['txtfld'];
  $sql = ("SELECT * FROM test_table WHERE adad = '$Mname'");
  if ($result = mysqli_query($dbc,$sql))
  </code></pre>
  
  <p>Now when i give 'a' as an input everything works as expected. I get back the one entry that has pk equal to [a].
  Query becomes :: SELECT * FROM test_table WHERE adad= 'a'.  </p>
  
  <p>Next step was to see if i can get the whole table or some random entry from it. 
  Input was : [ a' OR 'x'='x  ] 
  Query becomes :: SELECT * FROM test_table where adad = ' <strong><em>a' OR 'x' = 'x</em></strong> '
  Everything works as expected and i get back the whole table contents. </p>
  
  <p>Next step was to try inject a second query. I tried to update the test_table.
  Input was :: [ a;' update test_table set asda = '123456' where adad = 'u ]
  Query now becomes :: SELECT * FROM test_table WHERE adad= ' <strong>a;' UPDATE test_table SET asda ='123456' WHERE adad = 'u</strong> '</p>
  
  <p>I got a syntax error so i tried every syntax i could think of including 
  [ <strong>a;' UPDATE test_table SET asda = '123456' where adad = 'u';#</strong> ]
  . None of them worked. </p>
  
  <p>Thing is, i dont really get why i get a syntax error. </p>
  
  <p>For the input given above mysqli_error returns this message</p>
  
  <pre><code>error: You have an error in your SQL syntax; check the manual that corresponds to your
  MySQL server version for the right syntax to use near 'update test_table set asda =
  '123456' where adad = 'u'' at line 1 
  </code></pre>
  
  <p>while an echo i inserted returns this </p>
  
  <pre><code>SELECT * FROM test_table WHERE adad = 'a;' UPDATE test_table SET asda = '123456' WHERE 
  adad = 'u'
  </code></pre>
  
  <p>I dont see any syntax error in the echo return and i dont get where the second [ ' ] character in the end of the mysqli_error return, comes from. </p>
  
  <p>From what i understand this is rather a failure in executing a second query ( no matter what the query is - drop, insert, update )  </p>
  
  <p>Do i miss something?</p>
  
  <p>Thanks in advance.</p>
  
  <p>Michael.</p>