title: Is it possible through SQL injection to launch an UPDATE/DELETE statement from an INSERT/SELECT statement in MySQL?
body: <p>Let's take the following vulnerable query ($id not being escaped):</p>
  
  <pre><code>SELECT * FROM table WHERE id = $id
  </code></pre>
  
  <p>Would it be possible in MySQL 5.x to modify some data through an <strong>UPDATE</strong> statement which would appear <strong>inside</strong> the hacked SELECT statement?</p>
  
  <p>I thought about something using benchmark() function:</p>
  
  <pre><code>SELECT * FROM table WHERE id = id OR benchmark(1, (UPDATE ...))
  </code></pre>
  
  <p>But it doesn't seem to work:</p>
  
  <blockquote>
    <p>ERROR 1064 (42000): You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'UPDATE ...</p>
  </blockquote>
  
  <p>Any other possibilities not using stored procedure?</p>
  
  <p><strong>Edit: and nor using <em>multiple queries</em> of course...</strong></p>