title: Are multiline queries sql-injection safe?
body: <p>This might be a stupid question.
  Or maybe my hacking skills are limited (I don't practice them at all).</p>
  
  <p>I have a query that looks like this:</p>
  
  <pre><code>&lt;?php
  $query =&lt;&lt;&lt;eot
      SELECT      table_x.field1,
                  table_x.field2,
                  table_y.*,
                  table_z.field4
      FROM        (
                      SELECT ...
                  ) as table_y
      LEFT JOIN   table_x
      ON          table_x.field1 = table_y.field_x
      LEFT JOIN   table_z
      ON          table_z.field1 = table_y.field_z
      WHERE       table_x.field3 = '$something'
      AND         table_z.field4 = '1'
      AND         table_z.field5 = '2'
  eot;
  ?&gt;
  </code></pre>
  
  <p>I have a lot of other tests on <code>$something</code> before it gets used, like <code>$something = explode(' ',$something);</code> (which later result in a string) none of them intend to prevent injection but they make it hard for the given injection to get as is to the actual query.
  However, there are ways. We all know how easy it is to replace a space for something else which is still valid..</p>
  
  <p>So, it's not really a problem to make a potentially harmful piece of SQL reach that <code>$something</code>...
  But is there any way to comment the rest of the original query string if it is multi-line?</p>
  
  <p>I can comment <code>AND         table_z.field4 = '1'</code> using <code>;--</code> but can't comment the following <code>AND         table_z.field5 = '2'</code></p>
  
  <p>Is it possible to open a multi-line comment <code>/*</code> without closing it or something looked like and therefore allow the injection to ignore the multi-line query?</p>